908cf4765a7891dde70b7894eca85fe2846f04d3348dfb380840cbfe51af707f

Analysis

max time kernel
133s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 13:54

Target

NEAS.219900ce655a7f342fc4dd369b88acc0.exe
Size

188KB
MD5

219900ce655a7f342fc4dd369b88acc0
SHA1

a0ab8b5de14513378ca900639ab7ce6ccf35cb93
SHA256

908cf4765a7891dde70b7894eca85fe2846f04d3348dfb380840cbfe51af707f
SHA512

3ccb37dba62fbf1d8de26375e46878edbf39ee7f45584d3c9d280da9800947d2784350028fc9283d5ce8704284e5b08f67c6835ab640cb84924d9f242293cf92
SSDEEP

768:1OwyxiCz6vYkvFjHE8juLRjafwToWoDgCJzguySwJhi0/1H54/:1+ACIYkva8qVjafwTtxKsuCX6

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2776	4620	WerFault.exe	87
4244	4620	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 2776	4620	NEAS.219900ce655a7f342fc4dd369b88acc0.exe	92
PID 4620 wrote to memory of 2776	4620	NEAS.219900ce655a7f342fc4dd369b88acc0.exe	92
PID 4620 wrote to memory of 2776	4620	NEAS.219900ce655a7f342fc4dd369b88acc0.exe	92

C:\Users\Admin\AppData\Local\Temp\NEAS.219900ce655a7f342fc4dd369b88acc0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.219900ce655a7f342fc4dd369b88acc0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 224
  2⤵
  - Program crash
  PID:2776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 224
  2⤵
  - Program crash
  PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4620 -ip 4620
1⤵
PID:4048

memory/4620-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download