2fa0a4590092f3493cc4914727cdd8738d76393dcf301ea0ff5c6aea843e5fdd

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 13:51

Target

NEAS.06fd0084c39427befc607df352fd2490.exe
Size

272KB
MD5

06fd0084c39427befc607df352fd2490
SHA1

d0c554479ba6fe237c6ba974c5a50cf9ddad3ac1
SHA256

2fa0a4590092f3493cc4914727cdd8738d76393dcf301ea0ff5c6aea843e5fdd
SHA512

8d6882143821897c83691fa4cfc8469439042e33cf827a181deceb15550788e6370fe5b5466480370ce9bae6fb27986e5330a8cb0d7cf02c0aed896a0b79ae30
SSDEEP

3072:uRABfq8uVqZ2fQkbn1vVAva63HePH/RAPJ:uqfq8ug4fQkjxqvak+PH/RAR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	2168	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2204	2168	NEAS.06fd0084c39427befc607df352fd2490.exe	27
PID 2168 wrote to memory of 2204	2168	NEAS.06fd0084c39427befc607df352fd2490.exe	27
PID 2168 wrote to memory of 2204	2168	NEAS.06fd0084c39427befc607df352fd2490.exe	27
PID 2168 wrote to memory of 2204	2168	NEAS.06fd0084c39427befc607df352fd2490.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.06fd0084c39427befc607df352fd2490.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.06fd0084c39427befc607df352fd2490.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 36
  2⤵
  - Program crash
  PID:2204

memory/2168-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download