80ab417b21f17442cb6e976194ece4dce58f1aa6ca18b0a90bbf632a1b1c24fa

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 14:21

Target

NEAS.d92de0eff35512735d4046a22c7ee630.exe
Size

204KB
MD5

d92de0eff35512735d4046a22c7ee630
SHA1

e2b0d0577b4eec1e1792271e97d508eb6eaa648c
SHA256

80ab417b21f17442cb6e976194ece4dce58f1aa6ca18b0a90bbf632a1b1c24fa
SHA512

e03afb608fa217f5a7f0e4e1ce963802dcc9e5b2f902d46ce5ca4e5edb896ee8c4097a3cc91fec2d7e35df5e3b84c72283b7b2ef9a8bb9bcb1cf75981aeca6fe
SSDEEP

768:P6cPsAifwZJ0cZGUk6vJOBdhqm2PeaiBWJQekFnODU02p/1H5MXdnh:SccYH/Gnc+hmlJQeklOQ02Lg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	2576	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2792	2576	NEAS.d92de0eff35512735d4046a22c7ee630.exe	28
PID 2576 wrote to memory of 2792	2576	NEAS.d92de0eff35512735d4046a22c7ee630.exe	28
PID 2576 wrote to memory of 2792	2576	NEAS.d92de0eff35512735d4046a22c7ee630.exe	28
PID 2576 wrote to memory of 2792	2576	NEAS.d92de0eff35512735d4046a22c7ee630.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.d92de0eff35512735d4046a22c7ee630.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d92de0eff35512735d4046a22c7ee630.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 36
  2⤵
  - Program crash
  PID:2792

memory/2576-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download