81dddc3e405328988158db288c65a05467b5483aa51245dc2673e1765e6257f5

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 06:29

Target

NEAS.74cbf8eee68adbf7577cd8f2219955c0.exe
Size

268KB
MD5

74cbf8eee68adbf7577cd8f2219955c0
SHA1

63558050fff6bbd340c6538d2f67eca18563e623
SHA256

81dddc3e405328988158db288c65a05467b5483aa51245dc2673e1765e6257f5
SHA512

664f0399c84d5ddf8081ac20e76c4aafb40cdfd8c642b08778bafa5b27783a25737eea752455358fbbe81c5129326104f17b1885820597cbbe11ca99831e5f31
SSDEEP

3072:MVlC6AmTfXGmkcce5Ix7cEGrhkngpDvchkqbAIQ:SC6AmLnkQ5Ix4brq2Ah

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
856	796	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 856	796	NEAS.74cbf8eee68adbf7577cd8f2219955c0.exe	28
PID 796 wrote to memory of 856	796	NEAS.74cbf8eee68adbf7577cd8f2219955c0.exe	28
PID 796 wrote to memory of 856	796	NEAS.74cbf8eee68adbf7577cd8f2219955c0.exe	28
PID 796 wrote to memory of 856	796	NEAS.74cbf8eee68adbf7577cd8f2219955c0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.74cbf8eee68adbf7577cd8f2219955c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.74cbf8eee68adbf7577cd8f2219955c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 36
  2⤵
  - Program crash
  PID:856

memory/796-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download