c71acd3cd1587a7229a1f14345c1818840476932d9ebfbcb3d62c68dac5c476a

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 21:26

Target

NEAS.37a63782193e86be91a9a97060a30280_JC.exe
Size

204KB
MD5

37a63782193e86be91a9a97060a30280
SHA1

71f5e70d51a98a473db595e375f1b9e96482c10b
SHA256

c71acd3cd1587a7229a1f14345c1818840476932d9ebfbcb3d62c68dac5c476a
SHA512

193286d6315da71abf6b265a6abacca17582c759b9d11f912d632ec52280d43f5fcce9b8283981f7be22b04204c693c459bbbd66edacc85835e6b89f7443452f
SSDEEP

1536:EEBaoCXhTpfPR9aKxVRIg9kZIYbwX9rYfn34RQ:E0avNPpVSg94NbwqIe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1056	1676	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1056	1676	NEAS.37a63782193e86be91a9a97060a30280_JC.exe	28
PID 1676 wrote to memory of 1056	1676	NEAS.37a63782193e86be91a9a97060a30280_JC.exe	28
PID 1676 wrote to memory of 1056	1676	NEAS.37a63782193e86be91a9a97060a30280_JC.exe	28
PID 1676 wrote to memory of 1056	1676	NEAS.37a63782193e86be91a9a97060a30280_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.37a63782193e86be91a9a97060a30280_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.37a63782193e86be91a9a97060a30280_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 36
  2⤵
  - Program crash
  PID:1056

memory/1676-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download