60548139d2f808c5b67e72af7d177d2a4ba2b3cffc8dd2abb97c091441e2b0b7

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 08:22

Target

NEAS.eb7aa5b074af824d470f4b52ab3dc980_JC.exe
Size

244KB
MD5

eb7aa5b074af824d470f4b52ab3dc980
SHA1

b1488319cd60541fdbd1cd19bb3fe9a50b9cc558
SHA256

60548139d2f808c5b67e72af7d177d2a4ba2b3cffc8dd2abb97c091441e2b0b7
SHA512

a60250a8cd3d18427294a2471e63524969c7f276b5d27030061d789e34c9dda8a9481e5bbfd1e78b1b9ea5afade32ce85d7d4e0be16c762d11de8b99a06d92f5
SSDEEP

1536:y0tGlEIng/DfbHvgy8iaooVaB4mf8is8iar8ieJix8i:0lW/DfLgy80MaB4mf8B8Br87JE8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	2244	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1420	2244	NEAS.eb7aa5b074af824d470f4b52ab3dc980_JC.exe	28
PID 2244 wrote to memory of 1420	2244	NEAS.eb7aa5b074af824d470f4b52ab3dc980_JC.exe	28
PID 2244 wrote to memory of 1420	2244	NEAS.eb7aa5b074af824d470f4b52ab3dc980_JC.exe	28
PID 2244 wrote to memory of 1420	2244	NEAS.eb7aa5b074af824d470f4b52ab3dc980_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.eb7aa5b074af824d470f4b52ab3dc980_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.eb7aa5b074af824d470f4b52ab3dc980_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 36
  2⤵
  - Program crash
  PID:1420

memory/2244-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download