44d1133f45189400b32ffa8072e91bafaeca7a6e7f8c30db6a934c2ee6c3a66e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 07:14

Target

NEAS.8f37de3983c752463a29bfdfda3622a0.exe
Size

276KB
MD5

8f37de3983c752463a29bfdfda3622a0
SHA1

a650026ab359bf8e0d247606345c88643a112338
SHA256

44d1133f45189400b32ffa8072e91bafaeca7a6e7f8c30db6a934c2ee6c3a66e
SHA512

bb4673e0d0c903686754b3f560e854a3a67fe3111d1240291668e32f6e04fea1c67de7d2db904979a695f345300459dd0fffcda20b7c2841b742919733fc233f
SSDEEP

3072:z3UwQphmjFgHAr9ceN5nLoYDGNlib5qfpfGU:zEwQphmoArRvL7GNlighD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	1920	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2084	1920	NEAS.8f37de3983c752463a29bfdfda3622a0.exe	28
PID 1920 wrote to memory of 2084	1920	NEAS.8f37de3983c752463a29bfdfda3622a0.exe	28
PID 1920 wrote to memory of 2084	1920	NEAS.8f37de3983c752463a29bfdfda3622a0.exe	28
PID 1920 wrote to memory of 2084	1920	NEAS.8f37de3983c752463a29bfdfda3622a0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.8f37de3983c752463a29bfdfda3622a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.8f37de3983c752463a29bfdfda3622a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 36
  2⤵
  - Program crash
  PID:2084

memory/1920-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download