ba9c81fc3d7cdefeacbb25350b805fb97db1378f50e2827f5fe35a7a2619edbe

Analysis

max time kernel
121s
max time network
144s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 17:18

Target

NEAS.3f3bc1b99e6a932662e1aa806c6ef2f0.exe
Size

260KB
MD5

3f3bc1b99e6a932662e1aa806c6ef2f0
SHA1

fb0b33a0ac9bf264749679a5cb52421dac6012eb
SHA256

ba9c81fc3d7cdefeacbb25350b805fb97db1378f50e2827f5fe35a7a2619edbe
SHA512

de50373dfbc4de18550339a15a80135383ab3195b33b5b1bef9ea5a8ed8ba8aa5a1a3357295f458b2256235743309d3850c23dca6ab1b6260377ad5e37f6e692
SSDEEP

768:U7DApAJmxwUh6zO5g7Wfb8BvTRbdUE6Sijv7xCIJ2u2js/1H5OXdnhgdwQU3bIEW:ksASwKScoNSLDhJrWuWZrI1jHJZrR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	2904	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 1760	2904	NEAS.3f3bc1b99e6a932662e1aa806c6ef2f0.exe	27
PID 2904 wrote to memory of 1760	2904	NEAS.3f3bc1b99e6a932662e1aa806c6ef2f0.exe	27
PID 2904 wrote to memory of 1760	2904	NEAS.3f3bc1b99e6a932662e1aa806c6ef2f0.exe	27
PID 2904 wrote to memory of 1760	2904	NEAS.3f3bc1b99e6a932662e1aa806c6ef2f0.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.3f3bc1b99e6a932662e1aa806c6ef2f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3f3bc1b99e6a932662e1aa806c6ef2f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 36
  2⤵
  - Program crash
  PID:1760

memory/2904-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download