96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/10/2023, 17:36

Target

NEAS.96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862exe_JC.exe
Size

625KB
MD5

fe70407ea465935cbb99f6d306849e4c
SHA1

dddd5afc7e8979400944722317a95762deebb758
SHA256

96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862
SHA512

adad224cc8a6013b601ac7100cd170f26d59bf8108f3922061fbf286a8341b1d77adbdcf5d3cf2e534d4e7b97667791f72de9c0e9be60f472ca63291461c3138
SSDEEP

12288:p/jYEKKICL7LRQOQg2n4OiMmOFReT+j0rDlk1DaetfSrxIOPY9X0:pLYOIS+g0riMmDqwNmDa86x/P

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1180 set thread context of 2792	1180	NEAS.96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862exe_JC.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2792	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2792	1180	NEAS.96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862exe_JC.exe	30
PID 1180 wrote to memory of 2792	1180	NEAS.96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862exe_JC.exe	30
PID 1180 wrote to memory of 2792	1180	NEAS.96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862exe_JC.exe	30
PID 1180 wrote to memory of 2792	1180	NEAS.96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862exe_JC.exe	30
PID 1180 wrote to memory of 2792	1180	NEAS.96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862exe_JC.exe	30
PID 1180 wrote to memory of 2792	1180	NEAS.96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862exe_JC.exe	30
PID 1180 wrote to memory of 2792	1180	NEAS.96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862exe_JC.exe	30
PID 2792 wrote to memory of 3020	2792	NEAS.96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862exe_JC.exe	31
PID 2792 wrote to memory of 3020	2792	NEAS.96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862exe_JC.exe	31
PID 2792 wrote to memory of 3020	2792	NEAS.96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862exe_JC.exe	31
PID 2792 wrote to memory of 3020	2792	NEAS.96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862exe_JC.exe	31

memory/1180-6-0x0000000000210000-0x0000000000220000-memory.dmp

Filesize
64KB

Download
memory/1180-1-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/1180-2-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/1180-3-0x00000000003C0000-0x00000000003D8000-memory.dmp

Filesize
96KB

Download
memory/1180-4-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/1180-5-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/1180-0-0x0000000000FD0000-0x0000000001072000-memory.dmp

Filesize
648KB

Download
memory/1180-7-0x0000000005790000-0x000000000580A000-memory.dmp

Filesize
488KB

Download
memory/1180-14-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/2792-8-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2792-10-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2792-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2792-13-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download