8ff3f37d01d424cb3d286f12d296e88a7e90c21ad7f0f91613959ba0c73f7509

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 02:34

Target

NEAS.bd2778b3e67d78e5cea2c4f059f5e7d0.exe
Size

268KB
MD5

bd2778b3e67d78e5cea2c4f059f5e7d0
SHA1

7ada409dbe9bdfaa4362b0f7dd1f4649983f15c1
SHA256

8ff3f37d01d424cb3d286f12d296e88a7e90c21ad7f0f91613959ba0c73f7509
SHA512

ec3fe5226b829ad93011ee3204661ade30f9c7d6caa26d08523f832d578c8d87af5a071078ca90229ac1b5bda6779c8ba36a7760ee2339733de7f3e7bd570b9e
SSDEEP

1536:SQ3rJZEkv+ovmoE2kBPeQ98OybXwjXq+66DFUABABOVLefE:hFZFmovCjGQGgj6+JB8M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	2380	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2408	2380	NEAS.bd2778b3e67d78e5cea2c4f059f5e7d0.exe	28
PID 2380 wrote to memory of 2408	2380	NEAS.bd2778b3e67d78e5cea2c4f059f5e7d0.exe	28
PID 2380 wrote to memory of 2408	2380	NEAS.bd2778b3e67d78e5cea2c4f059f5e7d0.exe	28
PID 2380 wrote to memory of 2408	2380	NEAS.bd2778b3e67d78e5cea2c4f059f5e7d0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.bd2778b3e67d78e5cea2c4f059f5e7d0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.bd2778b3e67d78e5cea2c4f059f5e7d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 36
  2⤵
  - Program crash
  PID:2408

memory/2380-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download