154ff73d8d3556a85238c8dcd0050bd713af264abe4c3ee9005e7a24cca1d611

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/10/2023, 20:17

Target

NEAS.2023-09-05_33683ba20535bd4fccadaba645bed7c3_stop_JC.exe
Size

1.1MB
MD5

33683ba20535bd4fccadaba645bed7c3
SHA1

aacbabe42e8e1038fdb785cd5860ddc6b6a98a89
SHA256

154ff73d8d3556a85238c8dcd0050bd713af264abe4c3ee9005e7a24cca1d611
SHA512

5bc52746454d063e51ca7a572dc23104cc70b73f8d9647301356d502b9b9906f992e726c6499d8ac047a6747fa2379d22e8193be9639f01e40814e9bd3ece647
SSDEEP

24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/XRPOO8vVHUq7:F0dwAYZt6C31WeTPRPOhv5Uq7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	2512	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2180	2512	NEAS.2023-09-05_33683ba20535bd4fccadaba645bed7c3_stop_JC.exe	28
PID 2512 wrote to memory of 2180	2512	NEAS.2023-09-05_33683ba20535bd4fccadaba645bed7c3_stop_JC.exe	28
PID 2512 wrote to memory of 2180	2512	NEAS.2023-09-05_33683ba20535bd4fccadaba645bed7c3_stop_JC.exe	28
PID 2512 wrote to memory of 2180	2512	NEAS.2023-09-05_33683ba20535bd4fccadaba645bed7c3_stop_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_33683ba20535bd4fccadaba645bed7c3_stop_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_33683ba20535bd4fccadaba645bed7c3_stop_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 192
  2⤵
  - Program crash
  PID:2180