bab72a844da69016639f1c793372f896829ca66a55897ccdb431bbfdc0915200

Analysis

max time kernel
198s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 16:46

Target

NEAS.9ebdec5e654e5032dc4f6e46b6e63130.exe
Size

268KB
MD5

9ebdec5e654e5032dc4f6e46b6e63130
SHA1

cc5f268d152a5c5671d6648f3be748d2272ac933
SHA256

bab72a844da69016639f1c793372f896829ca66a55897ccdb431bbfdc0915200
SHA512

4ba74d5c5e1602d1879add8b919dac2c919846787e021a36f9b5ccac9d2329749524f86014d2a3eabbc29cdd5126faec008c8cbc9f46facbc7f9ce3f71c77a35
SSDEEP

3072:E/jBWqJDjQOx/EAKDZZe5hx7cEGrhkngpDvchkqbAIQ:EbBWqqOx/oZs5hx4brq2Ah

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4568	3180	WerFault.exe	84
2900	3180	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4568	3180	NEAS.9ebdec5e654e5032dc4f6e46b6e63130.exe	90
PID 3180 wrote to memory of 4568	3180	NEAS.9ebdec5e654e5032dc4f6e46b6e63130.exe	90
PID 3180 wrote to memory of 4568	3180	NEAS.9ebdec5e654e5032dc4f6e46b6e63130.exe	90

C:\Users\Admin\AppData\Local\Temp\NEAS.9ebdec5e654e5032dc4f6e46b6e63130.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9ebdec5e654e5032dc4f6e46b6e63130.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 224
  2⤵
  - Program crash
  PID:4568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 224
  2⤵
  - Program crash
  PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3180 -ip 3180
1⤵
PID:1292

memory/3180-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download