0d1bac014c7ee168218fed25bc32eb03e6ddec8f39435b4640f8a0635c5fad60

Analysis

max time kernel
126s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 09:00

Target

NEAS.f8addde7aeeebbda35d49e4b0f5d8d00.exe
Size

1.5MB
MD5

f8addde7aeeebbda35d49e4b0f5d8d00
SHA1

fa81a7c630a028b21511fef43a515b9d047fbb3c
SHA256

0d1bac014c7ee168218fed25bc32eb03e6ddec8f39435b4640f8a0635c5fad60
SHA512

7e9b507870136ecba10958cc9405390b0c875fc1e94c2a7eff8c9edebc640beb9acd39fa21a253319c82a08988973016343c1f138d10768152b001b3db983f05
SSDEEP

24576:3uq8X4FH0MyTpNjMlhlQk2MVXkoz7d9HZku6IQw156S045mWB1dxpGse7ehmhz4r:3y4l0MyTIlhlQe/16I9156E5mWBxpGsB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	4416	WerFault.exe	84

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4416	NEAS.f8addde7aeeebbda35d49e4b0f5d8d00.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.f8addde7aeeebbda35d49e4b0f5d8d00.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f8addde7aeeebbda35d49e4b0f5d8d00.exe"
1⤵
- Suspicious behavior: RenamesItself
PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 552
  2⤵
  - Program crash
  PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4416 -ip 4416
1⤵
PID:1612

memory/4416-0-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/4416-3-0x00000000022D0000-0x00000000022D2000-memory.dmp

Filesize
8KB

Download
memory/4416-4-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/4416-5-0x0000000003CD0000-0x0000000003CD2000-memory.dmp

Filesize
8KB

Download
memory/4416-6-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download