db72440c834569db2450cd2f066d9f85141d7fc511730030dba7a2dabb79ff63

Analysis

max time kernel
83s
max time network
31s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 13:50

Target

NEAS.008c00dbebb65a952d1e25de8ad5b8f0.exe
Size

256KB
MD5

008c00dbebb65a952d1e25de8ad5b8f0
SHA1

01011b8d52656076aadc7ade8ebb65d8ec9d413c
SHA256

db72440c834569db2450cd2f066d9f85141d7fc511730030dba7a2dabb79ff63
SHA512

eb0e6c9bf4e6c0ba676cd9b632116f4829844991ac6881a3729972763d3bce838bdc612e5f964db93c8c8c32937a66edd39cf6a6ed68c297088a2bdbcaf2adeb
SSDEEP

1536:nIQs2jJuu3m0nmotNNIIReyj1Hs38rGFUcMzTcFlExkg8F:nS0jiotNKmBHPvcMzTcFlakgw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2828	2680	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2828	2680	NEAS.008c00dbebb65a952d1e25de8ad5b8f0.exe	29
PID 2680 wrote to memory of 2828	2680	NEAS.008c00dbebb65a952d1e25de8ad5b8f0.exe	29
PID 2680 wrote to memory of 2828	2680	NEAS.008c00dbebb65a952d1e25de8ad5b8f0.exe	29
PID 2680 wrote to memory of 2828	2680	NEAS.008c00dbebb65a952d1e25de8ad5b8f0.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.008c00dbebb65a952d1e25de8ad5b8f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.008c00dbebb65a952d1e25de8ad5b8f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 36
  2⤵
  - Program crash
  PID:2828

memory/2680-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download