5374c31399831ea9f6f039f04cf50b15422bd6b60eb607800001a6cde0b4c675

Analysis

max time kernel
24s
max time network
18s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22-10-2023 17:27

Target

NEAS.c5a1a5a94f12472909d892516703dfa0.exe
Size

52KB
MD5

c5a1a5a94f12472909d892516703dfa0
SHA1

ff15f9b3955a6a703bf0e34a76089054a5504105
SHA256

5374c31399831ea9f6f039f04cf50b15422bd6b60eb607800001a6cde0b4c675
SHA512

0fe6210d4147fe9aa950d472126f2e6a6e56aacff6f50c28b004876ec14cd252189110fa4aa5780b7a7a4c4d1126d6c3093e0f8082bb9d8eff12de0c01781762
SSDEEP

768:AvAOKbSEln5IyYpamDjobj8ShSoRLVcNLq3K2Ev8pafSlRF1L/kcyLlc:Lbln5IUmDjoX9SpAEzG/hMct

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2492	2660	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2492	2660	NEAS.c5a1a5a94f12472909d892516703dfa0.exe	28
PID 2660 wrote to memory of 2492	2660	NEAS.c5a1a5a94f12472909d892516703dfa0.exe	28
PID 2660 wrote to memory of 2492	2660	NEAS.c5a1a5a94f12472909d892516703dfa0.exe	28
PID 2660 wrote to memory of 2492	2660	NEAS.c5a1a5a94f12472909d892516703dfa0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.c5a1a5a94f12472909d892516703dfa0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c5a1a5a94f12472909d892516703dfa0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 92
  2⤵
  - Program crash
  PID:2492

memory/2660-0-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/2660-1-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download