56fa653b69b6d23d0af64b13205ebec96d092f00083a09425ddcbb4dc9c7e03d

Analysis

max time kernel
244s
max time network
290s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 17:24

Target

NEAS.97b41ecb1ee380dd1050a771fad086b0.exe
Size

60KB
MD5

97b41ecb1ee380dd1050a771fad086b0
SHA1

4e1476d20a734c19fc05af4e34583b9f8060dec8
SHA256

56fa653b69b6d23d0af64b13205ebec96d092f00083a09425ddcbb4dc9c7e03d
SHA512

7e8f796f0994c975a5e03a68359d32c6d0b0c2f02f684a0b9a4a1f82848d0d1799177b8ce239f080f48772783b0fb9142314e5f4e9eabc7c483de2a1a84c5678
SSDEEP

384:60VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26a3WBWRYpetOOtEvwDpjqIGRmd:6Qz7yVEhs9+4rR7tOOtEvwDpjL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1776	2716	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 1776	2716	NEAS.97b41ecb1ee380dd1050a771fad086b0.exe	27
PID 2716 wrote to memory of 1776	2716	NEAS.97b41ecb1ee380dd1050a771fad086b0.exe	27
PID 2716 wrote to memory of 1776	2716	NEAS.97b41ecb1ee380dd1050a771fad086b0.exe	27
PID 2716 wrote to memory of 1776	2716	NEAS.97b41ecb1ee380dd1050a771fad086b0.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.97b41ecb1ee380dd1050a771fad086b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.97b41ecb1ee380dd1050a771fad086b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 36
  2⤵
  - Program crash
  PID:1776

memory/2716-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download