deff96a4b3a1b6147c416474a34a8c968aa45faeea10ffc78670d766fc8174ff

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 16:45

Target

NEAS.7f0956263247649555d39d0e8be6f3b0.exe
Size

72KB
MD5

7f0956263247649555d39d0e8be6f3b0
SHA1

7652e93831f3aa54b6d0fb1cb476d4112c1248e9
SHA256

deff96a4b3a1b6147c416474a34a8c968aa45faeea10ffc78670d766fc8174ff
SHA512

866d8371bf1a21873c8486f33cf7c6f32de0e9be72601b643ed2d6d54ed244e2b2548120482078f017981c1628a73f8c767332194136949d185f20cba545039c
SSDEEP

12:eH1GSG465M6akP1AZX1R9/EcGvacz5V0iCPAYKLORIBORLc:eH1GSAM63EX1R9/EbvacF6fPVKPBJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	2044	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2948	2044	NEAS.7f0956263247649555d39d0e8be6f3b0.exe	28
PID 2044 wrote to memory of 2948	2044	NEAS.7f0956263247649555d39d0e8be6f3b0.exe	28
PID 2044 wrote to memory of 2948	2044	NEAS.7f0956263247649555d39d0e8be6f3b0.exe	28
PID 2044 wrote to memory of 2948	2044	NEAS.7f0956263247649555d39d0e8be6f3b0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.7f0956263247649555d39d0e8be6f3b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7f0956263247649555d39d0e8be6f3b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 36
  2⤵
  - Program crash
  PID:2948

memory/2044-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download