eda145f78387b3e6a7f4b2abc60ef5b8ac034b761bd6c571000a1eafad82e1a5

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 14:08

Target

NEAS.503d0c733d68bb243cd196bc0bd8c600.exe
Size

228KB
MD5

503d0c733d68bb243cd196bc0bd8c600
SHA1

abf66f1ae593b658a694424ebaf7fdb5db75f745
SHA256

eda145f78387b3e6a7f4b2abc60ef5b8ac034b761bd6c571000a1eafad82e1a5
SHA512

727de9fbb2da3dd98213840f24f917692ffd3c1b37003744327fa5291b6989614d5e78ae880aa78fe0180bde5e8444da1a94b3c3ae9be5853116f08545a48cf7
SSDEEP

1536:XZDjpk8+uJoAfrkax5IUmb1tK3oimVcGiuyavOqPSiURQzDbEyRCRRRoR4Rk:9jpD+ufrkaDIUyKmViuTqrejEy032ya

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	2144	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2196	2144	NEAS.503d0c733d68bb243cd196bc0bd8c600.exe	28
PID 2144 wrote to memory of 2196	2144	NEAS.503d0c733d68bb243cd196bc0bd8c600.exe	28
PID 2144 wrote to memory of 2196	2144	NEAS.503d0c733d68bb243cd196bc0bd8c600.exe	28
PID 2144 wrote to memory of 2196	2144	NEAS.503d0c733d68bb243cd196bc0bd8c600.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.503d0c733d68bb243cd196bc0bd8c600.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.503d0c733d68bb243cd196bc0bd8c600.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 36
  2⤵
  - Program crash
  PID:2196

memory/2144-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download