44df7d9fbf30fadd5941201f52ff4a8c01ccd8f5cd0fd657c6da35cbe7f61d0f

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 03:31

Target

NEAS.402e47a8a331bcd64c98a2996625e510_JC.exe
Size

32KB
MD5

402e47a8a331bcd64c98a2996625e510
SHA1

2a88e1398ad0bf25a2e9f1fc29434205a57cc024
SHA256

44df7d9fbf30fadd5941201f52ff4a8c01ccd8f5cd0fd657c6da35cbe7f61d0f
SHA512

9f0ca4fcb7525c2a6566bf0d6de6f0c2fb0a2f9adc4b1ab6fbcb703a9be902655faf3bb922675a434fa4f6f1da67bd30c4565409a8bc8ff8bba51206e857b319
SSDEEP

384:8ZFzx06AaRIeeJvbfOer8PZR8Gz2WwNWWnBRaCIcPA0GftpBjQVERHRN7jPzlJG:8bzgx7OQ8Dzg5xiiVEBjb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2376	2500	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2376	2500	NEAS.402e47a8a331bcd64c98a2996625e510_JC.exe	30
PID 2500 wrote to memory of 2376	2500	NEAS.402e47a8a331bcd64c98a2996625e510_JC.exe	30
PID 2500 wrote to memory of 2376	2500	NEAS.402e47a8a331bcd64c98a2996625e510_JC.exe	30
PID 2500 wrote to memory of 2376	2500	NEAS.402e47a8a331bcd64c98a2996625e510_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.402e47a8a331bcd64c98a2996625e510_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.402e47a8a331bcd64c98a2996625e510_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 532
  2⤵
  - Program crash
  PID:2376

memory/2500-0-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/2500-1-0x0000000000A50000-0x0000000000A5A000-memory.dmp

Filesize
40KB

Download
memory/2500-2-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download