38d2ba6272491c70355afd087ed78d8052cb6bcd562998a86ba765f4f04334aa

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 14:22

Target

NEAS.e20eee8e7ac417ce3d18e13514e7e080.exe
Size

208KB
MD5

e20eee8e7ac417ce3d18e13514e7e080
SHA1

61bfc7ab109e4e02bc5ddb47dd07c97790681239
SHA256

38d2ba6272491c70355afd087ed78d8052cb6bcd562998a86ba765f4f04334aa
SHA512

0184562c405a24472eb9c7726574e74564464497e68286655c08d2600d3ca7d433e382d51c6fa91fad22c7f4eaf8586743d5d1e4615dea055425d3f187199861
SSDEEP

1536:iC3Ga7B3i2Rto9xFoJbZP19up4ADNm8lJ9fB/swp:iC3Ga7Fqx6lNylJ9fFswp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	2016	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2140	2016	NEAS.e20eee8e7ac417ce3d18e13514e7e080.exe	28
PID 2016 wrote to memory of 2140	2016	NEAS.e20eee8e7ac417ce3d18e13514e7e080.exe	28
PID 2016 wrote to memory of 2140	2016	NEAS.e20eee8e7ac417ce3d18e13514e7e080.exe	28
PID 2016 wrote to memory of 2140	2016	NEAS.e20eee8e7ac417ce3d18e13514e7e080.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.e20eee8e7ac417ce3d18e13514e7e080.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e20eee8e7ac417ce3d18e13514e7e080.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 36
  2⤵
  - Program crash
  PID:2140

memory/2016-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download