da16aec5cb0b5b984a32e4ca45a32a73266ca3e6148aedee8758de7f0ba66df3

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
23-10-2023 18:39

Target

NEAS.da16aec5cb0b5b984a32e4ca45a32a73266ca3e6148aedee8758de7f0ba66df3exe_JC.exe
Size

531KB
MD5

1547a83da18ae73b5570ced53296b7d3
SHA1

d24f9c3a567142783e20869bfbb44e8e84aa657d
SHA256

da16aec5cb0b5b984a32e4ca45a32a73266ca3e6148aedee8758de7f0ba66df3
SHA512

30c930d5caf6f0c839966694966cd2591e4f7a7a742c0fecc68e8077d25b57acb5620b0fbb6e1217c85d4f4f3840e574f6d80da9cfc298f91b78720eb88c160d
SSDEEP

12288:K60q1vjJGGna1WWgQ94bMYDLpzSr+MtL0NVS1eLVj/tWjFB1:T0q1LJ1na1teIYHpmr+igPooNMD1

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2932 2372 WerFault.exe NEAS.da16aec5cb0b5b984a32e4ca45a32a73266ca3e6148aedee8758de7f0ba66df3exe_JC.exe

pid	pid_target	process	target process
2932	2372	WerFault.exe	NEAS.da16aec5cb0b5b984a32e4ca45a32a73266ca3e6148aedee8758de7f0ba66df3exe_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

NEAS.da16aec5cb0b5b984a32e4ca45a32a73266ca3e6148aedee8758de7f0ba66df3exe_JC.exe

description	pid	process	target process
PID 2372 wrote to memory of 2932	2372	NEAS.da16aec5cb0b5b984a32e4ca45a32a73266ca3e6148aedee8758de7f0ba66df3exe_JC.exe	WerFault.exe
PID 2372 wrote to memory of 2932	2372	NEAS.da16aec5cb0b5b984a32e4ca45a32a73266ca3e6148aedee8758de7f0ba66df3exe_JC.exe	WerFault.exe
PID 2372 wrote to memory of 2932	2372	NEAS.da16aec5cb0b5b984a32e4ca45a32a73266ca3e6148aedee8758de7f0ba66df3exe_JC.exe	WerFault.exe
PID 2372 wrote to memory of 2932	2372	NEAS.da16aec5cb0b5b984a32e4ca45a32a73266ca3e6148aedee8758de7f0ba66df3exe_JC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.da16aec5cb0b5b984a32e4ca45a32a73266ca3e6148aedee8758de7f0ba66df3exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.da16aec5cb0b5b984a32e4ca45a32a73266ca3e6148aedee8758de7f0ba66df3exe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 668
2⤵
- Program crash
PID:2932

memory/2372-1-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-0-0x0000000000DB0000-0x0000000000E3A000-memory.dmp

Filesize
552KB

Download
memory/2372-2-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/2372-3-0x0000000000370000-0x0000000000382000-memory.dmp

Filesize
72KB

Download
memory/2372-4-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-5-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/2372-6-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download