c080d1d6ffb793b900f585ea225d96a5af3d957abdad315ac4dfc104e315e95b

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
28-10-2023 20:13

Target

NEAS.c74f0b8fbd6c57aac4b952bc876752c0.exe
Size

312KB
MD5

c74f0b8fbd6c57aac4b952bc876752c0
SHA1

7a41a2d480aeb28f981faca2e080734a86362a74
SHA256

c080d1d6ffb793b900f585ea225d96a5af3d957abdad315ac4dfc104e315e95b
SHA512

22bbdc6453c53ab7f8eb4d2a0bccb1b705f71743c2033b138c752e256850cef9c3c527f57ab2671044fead6999f75a168300fee39fa4f5176330c8e2eefeee14
SSDEEP

6144:eQV+JsdoOsOi/Cg87W/Wm/0JsMDcPT+5WGFJaZOFpEZMmQ8y:e2WDH/MW/Wm7MDgTuaZxZMma

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	1736	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2604	1736	NEAS.c74f0b8fbd6c57aac4b952bc876752c0.exe	28
PID 1736 wrote to memory of 2604	1736	NEAS.c74f0b8fbd6c57aac4b952bc876752c0.exe	28
PID 1736 wrote to memory of 2604	1736	NEAS.c74f0b8fbd6c57aac4b952bc876752c0.exe	28
PID 1736 wrote to memory of 2604	1736	NEAS.c74f0b8fbd6c57aac4b952bc876752c0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.c74f0b8fbd6c57aac4b952bc876752c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c74f0b8fbd6c57aac4b952bc876752c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 132
  2⤵
  - Program crash
  PID:2604

memory/1736-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1736-2-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download