096c26cf3199187a5dfe6ca01192edff344045ba159980b7d6a490c9bc6886a4

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23-10-2023 21:49

Target

NEAS.efcc3d524ba41d46469b640ba6fd8510_JC.exe
Size

220KB
MD5

efcc3d524ba41d46469b640ba6fd8510
SHA1

40575033700d7cc5c0168a498291ff04723958ea
SHA256

096c26cf3199187a5dfe6ca01192edff344045ba159980b7d6a490c9bc6886a4
SHA512

7bcc40b6df1273d04cb90afc4b3007646e73a8b321d33877708d9c62c6a465eb990195fafe249610b2c3bef7f00ce863765cf88b7141966ee65ed9fc2fea3eab
SSDEEP

1536:PUDRi9T5sJdi9bxHNr2pnx6KaUuP6iuwJRFLOWMoiH3:P8RinudiP52xx67lLdhXiH3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2448	292	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 292 wrote to memory of 2448	292	NEAS.efcc3d524ba41d46469b640ba6fd8510_JC.exe	28
PID 292 wrote to memory of 2448	292	NEAS.efcc3d524ba41d46469b640ba6fd8510_JC.exe	28
PID 292 wrote to memory of 2448	292	NEAS.efcc3d524ba41d46469b640ba6fd8510_JC.exe	28
PID 292 wrote to memory of 2448	292	NEAS.efcc3d524ba41d46469b640ba6fd8510_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.efcc3d524ba41d46469b640ba6fd8510_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.efcc3d524ba41d46469b640ba6fd8510_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 292 -s 36
  2⤵
  - Program crash
  PID:2448

memory/292-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download