f20f2db9cc29a0fe55bee155a8c40913c28887b4d752b64d0c7187358739f7ac

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:36

Target

NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe
Size

66KB
MD5

ed5b368b8311fd5c6dd1920a3895c740
SHA1

30075a79cd54b505dc5aa3242f6181d59a5780a7
SHA256

f20f2db9cc29a0fe55bee155a8c40913c28887b4d752b64d0c7187358739f7ac
SHA512

3f8c68bb262ea84940c6d315f54b4930f225c4648c0509ea234e74a579b422cdb246cac2bc8ea9fe22e86aafc29fd3d3a9631be13953d03b8e15d87b26f9dcc8
SSDEEP

768:vQFSrugMRYYRRFsz4aBU3ajU39oJLFBGG0tNeG97beETVi0vplfK+fPyOXW4w2Aq:riVsnU3GF0G0tUCeE5Txfin/m

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	2056	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1964	2056	NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe	28
PID 2056 wrote to memory of 1964	2056	NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe	28
PID 2056 wrote to memory of 1964	2056	NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe	28
PID 2056 wrote to memory of 1964	2056	NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ed5b368b8311fd5c6dd1920a3895c740.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 36
  2⤵
  - Program crash
  PID:1964

memory/2056-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2056-1-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download