92c50173a91277101953c68142ad163b822fcc7d0dfd17e50cb3ee468cd3396c

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 16:44

Target

NEAS.78e7359df05c36d604279fdeb55f9330.exe
Size

119KB
MD5

78e7359df05c36d604279fdeb55f9330
SHA1

d3d2a11f2ec8d98ef38060d5d032e52512cb60c7
SHA256

92c50173a91277101953c68142ad163b822fcc7d0dfd17e50cb3ee468cd3396c
SHA512

cbdd60ff9f764de9cb5a93d6a1485f8792bc6a4ae487b8bfbb8b05e7a6f97f23f6433352077f84c3b5a5cf07eded98d1d1cc172bd9851e3b81c6a1dcd75b12b6
SSDEEP

3072:ZGyK9AaV1mIZvFHgXfAYqqHqPg/a+HVzdI3N:ZGyfIZFHgPAYqqAD0pdI9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1064	2984	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1064	2984	NEAS.78e7359df05c36d604279fdeb55f9330.exe	28
PID 2984 wrote to memory of 1064	2984	NEAS.78e7359df05c36d604279fdeb55f9330.exe	28
PID 2984 wrote to memory of 1064	2984	NEAS.78e7359df05c36d604279fdeb55f9330.exe	28
PID 2984 wrote to memory of 1064	2984	NEAS.78e7359df05c36d604279fdeb55f9330.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.78e7359df05c36d604279fdeb55f9330.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.78e7359df05c36d604279fdeb55f9330.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 36
  2⤵
  - Program crash
  PID:1064

memory/2984-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2984-1-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download