908cf4765a7891dde70b7894eca85fe2846f04d3348dfb380840cbfe51af707f

Analysis

max time kernel
76s
max time network
39s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 13:54

Target

NEAS.219900ce655a7f342fc4dd369b88acc0.exe
Size

188KB
MD5

219900ce655a7f342fc4dd369b88acc0
SHA1

a0ab8b5de14513378ca900639ab7ce6ccf35cb93
SHA256

908cf4765a7891dde70b7894eca85fe2846f04d3348dfb380840cbfe51af707f
SHA512

3ccb37dba62fbf1d8de26375e46878edbf39ee7f45584d3c9d280da9800947d2784350028fc9283d5ce8704284e5b08f67c6835ab640cb84924d9f242293cf92
SSDEEP

768:1OwyxiCz6vYkvFjHE8juLRjafwToWoDgCJzguySwJhi0/1H54/:1+ACIYkva8qVjafwTtxKsuCX6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2764	2692	WerFault.exe	5

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2764	2692	NEAS.219900ce655a7f342fc4dd369b88acc0.exe	29
PID 2692 wrote to memory of 2764	2692	NEAS.219900ce655a7f342fc4dd369b88acc0.exe	29
PID 2692 wrote to memory of 2764	2692	NEAS.219900ce655a7f342fc4dd369b88acc0.exe	29
PID 2692 wrote to memory of 2764	2692	NEAS.219900ce655a7f342fc4dd369b88acc0.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.219900ce655a7f342fc4dd369b88acc0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.219900ce655a7f342fc4dd369b88acc0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 36
  2⤵
  - Program crash
  PID:2764

memory/2692-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download