8a45555fc151198515e1ae66a57e549f6455f21a26e91a6dfd475ba6425ae8dc

Analysis

max time kernel
120s
max time network
148s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-10-2023 21:18

Target

NEAS.456f6aa16aefbe1c9c736c36c1b28820.exe
Size

264KB
MD5

456f6aa16aefbe1c9c736c36c1b28820
SHA1

4a016d6e8d8a770e27b8229ec18460629b42ac66
SHA256

8a45555fc151198515e1ae66a57e549f6455f21a26e91a6dfd475ba6425ae8dc
SHA512

d1b139bb9a8ccbf6b8323f9d1d260ef1747d3e9b70a8f7f8afa1349a7474f088480ce1d43a9925ef613ea408579274b7b256a1258b77e1c3d08caa67bb2f6b70
SSDEEP

3072:9MntYHyLXZswajxv6UDd1AZoUBW3FJeRuaWNX:hHyLJsRxCmdWZHEFJ7aWN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	3012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3020	3012	NEAS.456f6aa16aefbe1c9c736c36c1b28820.exe	28
PID 3012 wrote to memory of 3020	3012	NEAS.456f6aa16aefbe1c9c736c36c1b28820.exe	28
PID 3012 wrote to memory of 3020	3012	NEAS.456f6aa16aefbe1c9c736c36c1b28820.exe	28
PID 3012 wrote to memory of 3020	3012	NEAS.456f6aa16aefbe1c9c736c36c1b28820.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.456f6aa16aefbe1c9c736c36c1b28820.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.456f6aa16aefbe1c9c736c36c1b28820.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 36
  2⤵
  - Program crash
  PID:3020

memory/3012-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download