dcb06a073139746015a8e816e699974f1396a8aba1dd60c696f6e283ac0ddce9

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 16:46

Target

NEAS.9b37c0ce5059ac057b1f62a31e9340b0.exe
Size

208KB
MD5

9b37c0ce5059ac057b1f62a31e9340b0
SHA1

9ed1b8176b95811bd482e0c9936a32dd44c0ab05
SHA256

dcb06a073139746015a8e816e699974f1396a8aba1dd60c696f6e283ac0ddce9
SHA512

f0f9aca8171d13d7e67f3ef34a68628ecd128a472c7d737b18e71becc442c39a3475b76960812a313b33df0c4c9f7c051a10b1a70c4275362e75971084a2451b
SSDEEP

768:npMeEXxR3F8UNvrJb0PztsYDpVLGc3HZWok/6pSyDkYyjrT/1H51Xdnh:nqzXF8CvrJ4PBhDP35RLmhd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	2400	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1372	2400	NEAS.9b37c0ce5059ac057b1f62a31e9340b0.exe	28
PID 2400 wrote to memory of 1372	2400	NEAS.9b37c0ce5059ac057b1f62a31e9340b0.exe	28
PID 2400 wrote to memory of 1372	2400	NEAS.9b37c0ce5059ac057b1f62a31e9340b0.exe	28
PID 2400 wrote to memory of 1372	2400	NEAS.9b37c0ce5059ac057b1f62a31e9340b0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.9b37c0ce5059ac057b1f62a31e9340b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9b37c0ce5059ac057b1f62a31e9340b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 36
  2⤵
  - Program crash
  PID:1372

memory/2400-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download