7917f4b4bfb07f5d28ffd78a28f6c7cc58488695c40354a446af943020f7bdd4

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 19:55

Target

NEAS.078dded2ef3befc16648e2da52140f20.exe
Size

88KB
MD5

078dded2ef3befc16648e2da52140f20
SHA1

33024c94cf87c2cfe4371be66f1e58839b5fcbd2
SHA256

7917f4b4bfb07f5d28ffd78a28f6c7cc58488695c40354a446af943020f7bdd4
SHA512

293860afc0fefddef44df1d7f0e146b8aea5c2554f723ff14a8a80930ed0b54d69284be29cadacce184d039ce5e13b21b17c3f16ee0701ee5fb85b85dcfeeb53
SSDEEP

1536:/nXYCXws94d16q3pK1SSY+A37feaCMJDmYsLIb4PvYqHB/AdGF:PYCguLq3pK1SSDADeak7dJHB/AdGF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	2972	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3032	2972	NEAS.078dded2ef3befc16648e2da52140f20.exe	28
PID 2972 wrote to memory of 3032	2972	NEAS.078dded2ef3befc16648e2da52140f20.exe	28
PID 2972 wrote to memory of 3032	2972	NEAS.078dded2ef3befc16648e2da52140f20.exe	28
PID 2972 wrote to memory of 3032	2972	NEAS.078dded2ef3befc16648e2da52140f20.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.078dded2ef3befc16648e2da52140f20.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.078dded2ef3befc16648e2da52140f20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 124
  2⤵
  - Program crash
  PID:3032

memory/2972-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2972-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download