d244ac2111e49721351ffdec42828302403ef923389a0d6a67cf66b81d7e0a30

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 16:43

Target

NEAS.62bc64320c2d7bf7b2280544fd74b2b0.exe
Size

204KB
MD5

62bc64320c2d7bf7b2280544fd74b2b0
SHA1

03056fba1edf981d1e39ae63e19003133fddf674
SHA256

d244ac2111e49721351ffdec42828302403ef923389a0d6a67cf66b81d7e0a30
SHA512

166f87088dc8dc5d8d75519bdbcf3ffa5a6385bf6c5f242215be5ae950426e221803f70d5177e4279064745e9e0fa65e23dbcc7b96c3e407f824177de28978f2
SSDEEP

768:YDApAJmxwUh6zO5g7Wfb8BvTRbdUE6Sijv7xCIa2RjX/1H5DXdnhg:asASwKScoNSLDh7h9v

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	884	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1956	884	NEAS.62bc64320c2d7bf7b2280544fd74b2b0.exe	28
PID 884 wrote to memory of 1956	884	NEAS.62bc64320c2d7bf7b2280544fd74b2b0.exe	28
PID 884 wrote to memory of 1956	884	NEAS.62bc64320c2d7bf7b2280544fd74b2b0.exe	28
PID 884 wrote to memory of 1956	884	NEAS.62bc64320c2d7bf7b2280544fd74b2b0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.62bc64320c2d7bf7b2280544fd74b2b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.62bc64320c2d7bf7b2280544fd74b2b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 36
  2⤵
  - Program crash
  PID:1956

memory/884-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download