efcf26b2a9394f2bf5a5630b623e14a585e340a924fff199f25249eb22fca9e0

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 16:44

Target
NEAS.7bcd5393bb3030154d82be1dbcd10180.exe
Size 3.7MB
Sample231102-t9b3psbb86
SHA256 efcf26b2a9394f2bf5a5630b623e14a585e340a924fff199f25249eb22fca9e0
MD5 7bcd5393bb3030154d82be1dbcd10180
SHA1 4f95dacaf28beb9cc97d2b8c46ab9c894419a571
SHA512 d692c170cbbd06970f053d963a3ddb4f5a3930d3f21280e6de61bf68964b19609e8a63ad285e41eb667b8c8ea69a2be9b10caa3b21b61d82e808d430ea66bf4d
SSDEEP 3072:6DVCyFxSYACXF8pIfBV04Eq0M4uddH2/sZH1GbY41iY8:6DVCynACXF8pIp7EFMFR2/i4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	1944	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2212	1944	NEAS.7bcd5393bb3030154d82be1dbcd10180.exe	28
PID 1944 wrote to memory of 2212	1944	NEAS.7bcd5393bb3030154d82be1dbcd10180.exe	28
PID 1944 wrote to memory of 2212	1944	NEAS.7bcd5393bb3030154d82be1dbcd10180.exe	28
PID 1944 wrote to memory of 2212	1944	NEAS.7bcd5393bb3030154d82be1dbcd10180.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.7bcd5393bb3030154d82be1dbcd10180.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7bcd5393bb3030154d82be1dbcd10180.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 36
  2⤵
  - Program crash
  PID:2212