590a4ee43715d13aacf8d8de0f9d4d280c50637a34b88854d1cfdd4a2b43f802

Analysis

max time kernel
141s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 16:41

Target

NEAS.1d7dff01d18fd2c86a7f4b76ea921280.exe
Size

204KB
MD5

1d7dff01d18fd2c86a7f4b76ea921280
SHA1

f4c511e49a241ff0b321868dd14a93c85eea71b0
SHA256

590a4ee43715d13aacf8d8de0f9d4d280c50637a34b88854d1cfdd4a2b43f802
SHA512

8c858f36ee7a9e344d896ddf9d7958d5acc9e0ebdbaf229ee4702843a93d7186512acd750f017aece1bd76524c87c508967998cc4d4e83237b3c2a043ec6e52d
SSDEEP

1536:1KH54x2DAlkbXYSDT9hICqvfql6nV5aUxibH2LBS:1854EAibXnT9hIC16V5JibsBS

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
756	1700	WerFault.exe	87
1904	1700	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 756	1700	NEAS.1d7dff01d18fd2c86a7f4b76ea921280.exe	93
PID 1700 wrote to memory of 756	1700	NEAS.1d7dff01d18fd2c86a7f4b76ea921280.exe	93
PID 1700 wrote to memory of 756	1700	NEAS.1d7dff01d18fd2c86a7f4b76ea921280.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.1d7dff01d18fd2c86a7f4b76ea921280.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1d7dff01d18fd2c86a7f4b76ea921280.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 224
  2⤵
  - Program crash
  PID:756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 224
  2⤵
  - Program crash
  PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1700 -ip 1700
1⤵
PID:3368

memory/1700-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download