4686807f5fee35403c17c26b3b3d7553ed441bf1e394aa088cecbd1501e71f84

Analysis

max time kernel
139s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2023, 21:15

Target

NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe
Size

977KB
MD5

217bf1e91e2f97480aebb4c5a7469a50
SHA1

43330fbc55a6a3e71a22346b8e8e787d963b6c48
SHA256

4686807f5fee35403c17c26b3b3d7553ed441bf1e394aa088cecbd1501e71f84
SHA512

e595e7b1eee0f06e757e4a528544eb90c97cffb812fade23faa55f051799593104824d4310360d99569c45aa16a43a0d02a9dd230feec593971dd8044edc0285
SSDEEP

24576:Qre6+11JdAwqsI95DsvwLeqTSYDwAnzclpXsPKClgjP7nJ0:0+1DysisVqTSYDeuKBjnJ0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
796	5084	WerFault.exe	20

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 1424	5084	NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe	45
PID 5084 wrote to memory of 1424	5084	NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe	45

C:\Users\Admin\AppData\Local\Temp\NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.217bf1e91e2f97480aebb4c5a7469a50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 664
  2⤵
  - Program crash
  PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5084 -ip 5084
1⤵
PID:4980

memory/5084-0-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/5084-1-0x0000000000400000-0x000000000075B000-memory.dmp

Filesize
3.4MB

Download