13e0b5e802173e452fd4e8dda521aaf409d62a06654c706e1fe3b96ef6b985ad

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 08:19

Target

NEAS.755e63dd15cd7a862af809f413b225c0.exe
Size

208KB
MD5

755e63dd15cd7a862af809f413b225c0
SHA1

f83a266f90343afe3a09d3fb14cf74ca4cfa2668
SHA256

13e0b5e802173e452fd4e8dda521aaf409d62a06654c706e1fe3b96ef6b985ad
SHA512

c704da4e883fbe08cac9186e6042b92570c6a255d540f0134ced94f6db58ca19e4aa91d135a246ede1bdb58c31ca7209238b3a3c137558f45bfb263f1c3d722c
SSDEEP

1536:LzSRh0/+Vxm+YhDaV0n4b4iEFNBEcDU4IRQqR:LmRhO+VE+mDU04bLEFNBEcg4Ieq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	1212	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1744	1212	NEAS.755e63dd15cd7a862af809f413b225c0.exe	28
PID 1212 wrote to memory of 1744	1212	NEAS.755e63dd15cd7a862af809f413b225c0.exe	28
PID 1212 wrote to memory of 1744	1212	NEAS.755e63dd15cd7a862af809f413b225c0.exe	28
PID 1212 wrote to memory of 1744	1212	NEAS.755e63dd15cd7a862af809f413b225c0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.755e63dd15cd7a862af809f413b225c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.755e63dd15cd7a862af809f413b225c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 36
  2⤵
  - Program crash
  PID:1744

memory/1212-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download