506259697b9dfa91c12cbfecdace75a807f9a9349eb75933b12777bccb9180e2

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 17:16

Target

NEAS.3187b3d08936ba6094694e3c2830ac10.exe
Size

3.4MB
MD5

3187b3d08936ba6094694e3c2830ac10
SHA1

6565a75557666cda90bffa47f951d0158f067280
SHA256

506259697b9dfa91c12cbfecdace75a807f9a9349eb75933b12777bccb9180e2
SHA512

72384f18f5b76d50e3675e264b199dba2c46db9e8e58251180e197c9cc8c29987c4295899565ee4ecad50d90db9eb26b99c50b1b2d3702597fe604c5d37ab2c0
SSDEEP

98304:RhQpw4IcKr9dzTgJDAD2DxDUDUDDDpDbDyD+DRDqDgDTDZD7DUDlDaDCDgDHD:EIr9pU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	2160	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2452	2160	NEAS.3187b3d08936ba6094694e3c2830ac10.exe	28
PID 2160 wrote to memory of 2452	2160	NEAS.3187b3d08936ba6094694e3c2830ac10.exe	28
PID 2160 wrote to memory of 2452	2160	NEAS.3187b3d08936ba6094694e3c2830ac10.exe	28
PID 2160 wrote to memory of 2452	2160	NEAS.3187b3d08936ba6094694e3c2830ac10.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.3187b3d08936ba6094694e3c2830ac10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3187b3d08936ba6094694e3c2830ac10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 432
  2⤵
  - Program crash
  PID:2452

memory/2160-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2160-1-0x0000000000400000-0x000000000076F000-memory.dmp

Filesize
3.4MB

Download
memory/2160-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download