4686807f5fee35403c17c26b3b3d7553ed441bf1e394aa088cecbd1501e71f84

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-10-2023 21:15

Target

NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe
Size

977KB
MD5

217bf1e91e2f97480aebb4c5a7469a50
SHA1

43330fbc55a6a3e71a22346b8e8e787d963b6c48
SHA256

4686807f5fee35403c17c26b3b3d7553ed441bf1e394aa088cecbd1501e71f84
SHA512

e595e7b1eee0f06e757e4a528544eb90c97cffb812fade23faa55f051799593104824d4310360d99569c45aa16a43a0d02a9dd230feec593971dd8044edc0285
SSDEEP

24576:Qre6+11JdAwqsI95DsvwLeqTSYDwAnzclpXsPKClgjP7nJ0:0+1DysisVqTSYDeuKBjnJ0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2272	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2684	2272	NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe	28
PID 2272 wrote to memory of 2684	2272	NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe	28
PID 2272 wrote to memory of 2684	2272	NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe	28
PID 2272 wrote to memory of 2684	2272	NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe	28
PID 2272 wrote to memory of 2800	2272	NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe	29
PID 2272 wrote to memory of 2800	2272	NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe	29
PID 2272 wrote to memory of 2800	2272	NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe	29
PID 2272 wrote to memory of 2800	2272	NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 384
  2⤵
  - Program crash
  PID:2800

memory/2272-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2272-2-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download
memory/2272-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download