5d2f923e36c3e68a1cad9a9290a956649a9ced1081a4bcdfe4ddf28538dc6a6f

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 14:14

Target

NEAS.8d29a46d6125aa1653e641997d2a1860.exe
Size

240KB
MD5

8d29a46d6125aa1653e641997d2a1860
SHA1

244a45eae8b2837837feb37dceea15f7e72522d2
SHA256

5d2f923e36c3e68a1cad9a9290a956649a9ced1081a4bcdfe4ddf28538dc6a6f
SHA512

869893d4c63ebff5a6d1e401d1c1efbebd03b12ce9056b5262fdd6202cab68e834a1bcf10afdb45c534119763e96065020a3fdf2dcbb166e9ab549805fbb1095
SSDEEP

1536:o7+eltm8Y6jHO86s/3X6L3Nein/GFZCeDAy:illL7O86s/H6L3NFn/GFZC1y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2064	WerFault.exe	7

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2928	2064	NEAS.8d29a46d6125aa1653e641997d2a1860.exe	28
PID 2064 wrote to memory of 2928	2064	NEAS.8d29a46d6125aa1653e641997d2a1860.exe	28
PID 2064 wrote to memory of 2928	2064	NEAS.8d29a46d6125aa1653e641997d2a1860.exe	28
PID 2064 wrote to memory of 2928	2064	NEAS.8d29a46d6125aa1653e641997d2a1860.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.8d29a46d6125aa1653e641997d2a1860.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.8d29a46d6125aa1653e641997d2a1860.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 36
  2⤵
  - Program crash
  PID:2928

memory/2064-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download