96651b20040ccdfb1501027f98949e47d83c1636b78228115fa1c1a57c577fab

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 11:08

Target

NEAS.ec3c276fb01d864a3c36a707a30da9c0_JC.exe
Size

204KB
MD5

ec3c276fb01d864a3c36a707a30da9c0
SHA1

589d6cbb9d409451e2c861a38b52e354f4c65810
SHA256

96651b20040ccdfb1501027f98949e47d83c1636b78228115fa1c1a57c577fab
SHA512

09a7d927b1074116d20527c382af32a2932749ab57ddfe8660188452e89909f7f825c7875c048717829c8f0a55800f32fd202528577a18120462dbd36677d56a
SSDEEP

768:7ARgC0wl0rOK4/IryLSTS+XIvAPfHM7evqqDM2gv5Kz2LBUET55GlCTgRZ6Av8Q5:MCC4Tg0SlvmfpRBc5/LCS5/TgR1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1112	2460	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1112	2460	NEAS.ec3c276fb01d864a3c36a707a30da9c0_JC.exe	28
PID 2460 wrote to memory of 1112	2460	NEAS.ec3c276fb01d864a3c36a707a30da9c0_JC.exe	28
PID 2460 wrote to memory of 1112	2460	NEAS.ec3c276fb01d864a3c36a707a30da9c0_JC.exe	28
PID 2460 wrote to memory of 1112	2460	NEAS.ec3c276fb01d864a3c36a707a30da9c0_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.ec3c276fb01d864a3c36a707a30da9c0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ec3c276fb01d864a3c36a707a30da9c0_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 36
  2⤵
  - Program crash
  PID:1112

memory/2460-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download