39baad9873939ad44b0d393ef851ddc030556a7a3b32f95931111ce7bee1a480

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 16:42

Target

NEAS.3bc052e84a84d076a35109488de7cd60.exe
Size

119KB
MD5

3bc052e84a84d076a35109488de7cd60
SHA1

0d5174031a45cc23097504b8ce1c3c8e13013cc5
SHA256

39baad9873939ad44b0d393ef851ddc030556a7a3b32f95931111ce7bee1a480
SHA512

4827b7f7fa9f07aa910f396be7f25774e5555727981859f4cf17a7a865c233b3dc88a762c02eac8c727f1f91459cef17226a7a9bee35e7a96bcc83a830634f85
SSDEEP

3072:G04H/odS61L37jZUzChhpqmcoJPl+F/YLfaCAyeW:G0SMLLjZS2HvcoJ9m/YLZVeW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	2524	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2884	2524	NEAS.3bc052e84a84d076a35109488de7cd60.exe	28
PID 2524 wrote to memory of 2884	2524	NEAS.3bc052e84a84d076a35109488de7cd60.exe	28
PID 2524 wrote to memory of 2884	2524	NEAS.3bc052e84a84d076a35109488de7cd60.exe	28
PID 2524 wrote to memory of 2884	2524	NEAS.3bc052e84a84d076a35109488de7cd60.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.3bc052e84a84d076a35109488de7cd60.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3bc052e84a84d076a35109488de7cd60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 36
  2⤵
  - Program crash
  PID:2884

memory/2524-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2524-1-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download