465be81fdeeaa1e2a9632d16115427be47b2fe97faefcdfbc375e165db3da63c

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 04:07

Target

NEAS.faa9e71d23c48954161dd79fc0725df0.exe
Size

204KB
MD5

faa9e71d23c48954161dd79fc0725df0
SHA1

5139165809ab8e1967ac4e8f68394567808f77c7
SHA256

465be81fdeeaa1e2a9632d16115427be47b2fe97faefcdfbc375e165db3da63c
SHA512

c9916cadbcaea2d45cca61d4a0ff31fc61d1da08d6ae5068ff0966da702ce512e593fc934bff883f0bcb3c32d748f80d3254e44c3575dbf9a286269c07d02494
SSDEEP

768:YDApAJmxwUh6zO5g7Wfb8BvTRbdUE6Sijv7xCIp2RjX/1H5xXdnhg:asASwKScoNSLDh0h9p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2132	2496	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2132	2496	NEAS.faa9e71d23c48954161dd79fc0725df0.exe	28
PID 2496 wrote to memory of 2132	2496	NEAS.faa9e71d23c48954161dd79fc0725df0.exe	28
PID 2496 wrote to memory of 2132	2496	NEAS.faa9e71d23c48954161dd79fc0725df0.exe	28
PID 2496 wrote to memory of 2132	2496	NEAS.faa9e71d23c48954161dd79fc0725df0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.faa9e71d23c48954161dd79fc0725df0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.faa9e71d23c48954161dd79fc0725df0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 36
  2⤵
  - Program crash
  PID:2132

memory/2496-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download