dadfcc3716aa5e0807fba2ea01f5fbc55ed70b198dd5b5a8e869e92c476c6a6c

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
28-10-2023 20:11

Target

NEAS.b4976599b3df30c21771e08466173270.exe
Size

68KB
MD5

b4976599b3df30c21771e08466173270
SHA1

9ea4988c7b5dc9693f4db6e2cda2d37cf003d2f4
SHA256

dadfcc3716aa5e0807fba2ea01f5fbc55ed70b198dd5b5a8e869e92c476c6a6c
SHA512

e9ae148461a9d481057de9d2db32f3b6d2f158358eb0586b0c5f99f2b2802aee60ed8e9c188a7204e1fc0d61eeb745bd2087a9985aeb983e470801d47daf625d
SSDEEP

192:f1GhZ/WM4fivwWBxizWRAtG2UjI/hZ/WM4fivwWBxizWRAtG2UjI:NGX/WM4m6zGAttU4X/WM4m6zGAttU

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1684-0-0x0000000000400000-0x0000000000411000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	1684	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2588	1684	NEAS.b4976599b3df30c21771e08466173270.exe	28
PID 1684 wrote to memory of 2588	1684	NEAS.b4976599b3df30c21771e08466173270.exe	28
PID 1684 wrote to memory of 2588	1684	NEAS.b4976599b3df30c21771e08466173270.exe	28
PID 1684 wrote to memory of 2588	1684	NEAS.b4976599b3df30c21771e08466173270.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.b4976599b3df30c21771e08466173270.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b4976599b3df30c21771e08466173270.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 36
  2⤵
  - Program crash
  PID:2588

memory/1684-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download