00208e117b76415083a64b680e7299ecee2795a3e0ef8f183bcbc50249d9c995

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 14:24

Target

NEAS.f8d113d68755130bedb3e005de16ed20.exe
Size

204KB
MD5

f8d113d68755130bedb3e005de16ed20
SHA1

5056f1ba9536016ee1b69bca3be77303e16ddc0b
SHA256

00208e117b76415083a64b680e7299ecee2795a3e0ef8f183bcbc50249d9c995
SHA512

219b158cc92b7126fccdc1d2aeb8889b1ad5774046140111678e34d6d44e5d18b0313907b9dfdebcce4d842c28933720a3c4f2ce8c063fcf8e8b18c5461db308
SSDEEP

768:P6cPsAifwZJ0cZGUk6vJOBdhqm2PeaiBWJQekLOKhU02p/1H5oXdnh:SccYH/Gnc+hmlJQekSv02LU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	2760	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2664	2760	NEAS.f8d113d68755130bedb3e005de16ed20.exe	28
PID 2760 wrote to memory of 2664	2760	NEAS.f8d113d68755130bedb3e005de16ed20.exe	28
PID 2760 wrote to memory of 2664	2760	NEAS.f8d113d68755130bedb3e005de16ed20.exe	28
PID 2760 wrote to memory of 2664	2760	NEAS.f8d113d68755130bedb3e005de16ed20.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.f8d113d68755130bedb3e005de16ed20.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f8d113d68755130bedb3e005de16ed20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 36
  2⤵
  - Program crash
  PID:2664

memory/2760-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download