820783fdc46f0e509238ece6a5407423c90cfe3a173aac0f0df90ee45b880144

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 16:45

Target

NEAS.8146e9bd49f80d0a06f07c427ab203e0.exe
Size

272KB
MD5

8146e9bd49f80d0a06f07c427ab203e0
SHA1

bba84d8fc0b25faa2841669283595c981313e4aa
SHA256

820783fdc46f0e509238ece6a5407423c90cfe3a173aac0f0df90ee45b880144
SHA512

e4936bf54fe928c41f28ee805b20707d710af42c1260ea60ae5ac17004a5e7c73df264479a925ff15d2236b1dece36ded4ef7659b481480344a0291ff07980b7
SSDEEP

3072:Jf4JdTigJkCnDF/HPelziJPLCqwzBu1DjHLMVDqqkSp:ZKT/J7Dtv8ziJjwtu1DjrFqh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	768	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 2244	768	NEAS.8146e9bd49f80d0a06f07c427ab203e0.exe	28
PID 768 wrote to memory of 2244	768	NEAS.8146e9bd49f80d0a06f07c427ab203e0.exe	28
PID 768 wrote to memory of 2244	768	NEAS.8146e9bd49f80d0a06f07c427ab203e0.exe	28
PID 768 wrote to memory of 2244	768	NEAS.8146e9bd49f80d0a06f07c427ab203e0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.8146e9bd49f80d0a06f07c427ab203e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.8146e9bd49f80d0a06f07c427ab203e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 36
  2⤵
  - Program crash
  PID:2244

memory/768-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download