59e1c76d0c17f7212d587daadb3fdcccd09516bc81f2aa7beb6d045d1455d2da

Analysis

max time kernel
47s
max time network
21s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 10:00

Target

NEAS.dcbda0fba0fcfd1560ff13022c031ae0_JC.exe
Size

228KB
MD5

dcbda0fba0fcfd1560ff13022c031ae0
SHA1

c7556cbec2e17370d4824cc14b4ef78cac3551c4
SHA256

59e1c76d0c17f7212d587daadb3fdcccd09516bc81f2aa7beb6d045d1455d2da
SHA512

23f7edfd55c3d9bfa52035c543308e70b81e00c6fe113e0d36b8c5a380cfba239865ed2a27ab88d956d17a0f237509d2d903346bb5293a7fd8873be7eb3663bd
SSDEEP

1536:RHXMvvfPJJnarbqt5SMpuCSOOD1ueSYBWAhOVZg5RQTDbEyRCRRRoR4Rk:hX0JRiqt5nuhJ76AEVZ4eDEy032ya

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	2632	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2668	2632	NEAS.dcbda0fba0fcfd1560ff13022c031ae0_JC.exe	29
PID 2632 wrote to memory of 2668	2632	NEAS.dcbda0fba0fcfd1560ff13022c031ae0_JC.exe	29
PID 2632 wrote to memory of 2668	2632	NEAS.dcbda0fba0fcfd1560ff13022c031ae0_JC.exe	29
PID 2632 wrote to memory of 2668	2632	NEAS.dcbda0fba0fcfd1560ff13022c031ae0_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.dcbda0fba0fcfd1560ff13022c031ae0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.dcbda0fba0fcfd1560ff13022c031ae0_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 36
  2⤵
  - Program crash
  PID:2668

memory/2632-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download