1ed344b140f30375cb0e808e337e3aa4919dbec7ad538c52711f3804933377e7

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 13:54

Target

NEAS.220e628d86dddc198cf51cf5599faed0.exe
Size

27KB
MD5

220e628d86dddc198cf51cf5599faed0
SHA1

713be6d005f0a928ed10e4e5c5b9745eac609949
SHA256

1ed344b140f30375cb0e808e337e3aa4919dbec7ad538c52711f3804933377e7
SHA512

3339c54ee8203cf0bb19da29fe4fc038b9ac6314e59f651ced32354643b82d7ee6c8b42165a848784bd63f14cc3b68c75df3d35be8bc9e86ab8f99297944b260
SSDEEP

384:Zm8dzUpQJ1v2+LLX66/WQRvszgEBAyu69gJPIuw4BqDQybPp13HZ:91UpQJ1vzqMWQk3uLPdw4sDQI3J

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3628 set thread context of 3856	3628	NEAS.220e628d86dddc198cf51cf5599faed0.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
932	3856	WerFault.exe	86

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3856	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3856	3628	NEAS.220e628d86dddc198cf51cf5599faed0.exe	86
PID 3628 wrote to memory of 3856	3628	NEAS.220e628d86dddc198cf51cf5599faed0.exe	86
PID 3628 wrote to memory of 3856	3628	NEAS.220e628d86dddc198cf51cf5599faed0.exe	86
PID 3628 wrote to memory of 3856	3628	NEAS.220e628d86dddc198cf51cf5599faed0.exe	86
PID 3628 wrote to memory of 3856	3628	NEAS.220e628d86dddc198cf51cf5599faed0.exe	86

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3856 -ip 3856
1⤵
PID:4156

memory/3628-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3628-5-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3856-1-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download