99b6f9cf98836ad08b83e42e73151fc14ea6f4ceb1fdd64fe190b086b67b83a9

Analysis

max time kernel
133s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 13:56

Target

NEAS.2a42dd4f4804d66609503f2c3dd383b0.exe
Size

364KB
MD5

2a42dd4f4804d66609503f2c3dd383b0
SHA1

eb54f17b26300b6c61f1eb78f8287ec8823500a9
SHA256

99b6f9cf98836ad08b83e42e73151fc14ea6f4ceb1fdd64fe190b086b67b83a9
SHA512

22521b11675d6aab2e1f389b5bd0ff915090fdf477f3b3178fcdca09336a440b4e62c0fe5fa8ae9308d8c185743ba1c2463b00c8094a3ec1700426a0d41687c7
SSDEEP

3072:J/yXvD2enVN5UkLPp1f5mbUM96Zvx+UZkxvU84xUa4bjRTItEcmHA:J/yfD2Apf04GuvIUZeqJ2jydmHA

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3296	4728	WerFault.exe	85
3852	4728	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 3296	4728	NEAS.2a42dd4f4804d66609503f2c3dd383b0.exe	94
PID 4728 wrote to memory of 3296	4728	NEAS.2a42dd4f4804d66609503f2c3dd383b0.exe	94
PID 4728 wrote to memory of 3296	4728	NEAS.2a42dd4f4804d66609503f2c3dd383b0.exe	94

C:\Users\Admin\AppData\Local\Temp\NEAS.2a42dd4f4804d66609503f2c3dd383b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2a42dd4f4804d66609503f2c3dd383b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 452
  2⤵
  - Program crash
  PID:3296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 452
  2⤵
  - Program crash
  PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4728 -ip 4728
1⤵
PID:4856

memory/4728-0-0x0000000000740000-0x000000000079B000-memory.dmp

Filesize
364KB

Download
memory/4728-1-0x0000000000740000-0x000000000079B000-memory.dmp

Filesize
364KB

Download
memory/4728-2-0x0000000000740000-0x000000000079B000-memory.dmp

Filesize
364KB

Download