fb220fe113010fb02a51df3b7a66601cd60bdf89b230ca901aa1a8d05f32b876

Analysis

max time kernel
11s
max time network
18s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:31

Target

NEAS.c8cbc599574a88719f6b42a39e423db0.exe
Size

208KB
MD5

c8cbc599574a88719f6b42a39e423db0
SHA1

d53dbc28ff89f1b6e15765de60c90f000a6691a1
SHA256

fb220fe113010fb02a51df3b7a66601cd60bdf89b230ca901aa1a8d05f32b876
SHA512

9f8788d3315a4c04dae28027701051c09eadcedec9f7bd566cb66af70cce4d42e63d6bd011e313d558bd8c75b9321fd2dc833d49f83cfffad4410c3aa09a24e8
SSDEEP

768:mDApAJmxwUh6zO5g7Wfb8BvTRbdUE6Sijv7xCIP2xNjX/1H5DbXdnhgl:ksASwKScoNSLDhPgt9X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	2060	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2092	2060	NEAS.c8cbc599574a88719f6b42a39e423db0.exe	28
PID 2060 wrote to memory of 2092	2060	NEAS.c8cbc599574a88719f6b42a39e423db0.exe	28
PID 2060 wrote to memory of 2092	2060	NEAS.c8cbc599574a88719f6b42a39e423db0.exe	28
PID 2060 wrote to memory of 2092	2060	NEAS.c8cbc599574a88719f6b42a39e423db0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.c8cbc599574a88719f6b42a39e423db0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c8cbc599574a88719f6b42a39e423db0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 36
  2⤵
  - Program crash
  PID:2092

memory/2060-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download