17fc54708042391d11d8b674502d204e71582e3c238cab9cf0eadbe321735785

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 07:49

Target

NEAS.9d14c9561d496f9ab15782b9d53f3ef0.exe
Size

204KB
MD5

9d14c9561d496f9ab15782b9d53f3ef0
SHA1

c2a5aea638e0d8e13d4094d65a6a62ad1a473f87
SHA256

17fc54708042391d11d8b674502d204e71582e3c238cab9cf0eadbe321735785
SHA512

ee0a9a6b88e442b226bd0c0976ba4a46af6bd05186369e365e571f6a3d48fcd0388fa13b0a0784ced9df5fc28fac5bcd2c2a3ee4e61a81c0c432fa6d6662b747
SSDEEP

768:NNLXWPYAltslOzYuTPSccNr10WJ8eVVbnWbmh3R3OonX9Sjn6oJdz/1H5EXdnhg:/+gmTqcc921eXbWbmJR3OoXs6o/BY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1904	1884	WerFault.exe	2

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1904	1884	NEAS.9d14c9561d496f9ab15782b9d53f3ef0.exe	28
PID 1884 wrote to memory of 1904	1884	NEAS.9d14c9561d496f9ab15782b9d53f3ef0.exe	28
PID 1884 wrote to memory of 1904	1884	NEAS.9d14c9561d496f9ab15782b9d53f3ef0.exe	28
PID 1884 wrote to memory of 1904	1884	NEAS.9d14c9561d496f9ab15782b9d53f3ef0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.9d14c9561d496f9ab15782b9d53f3ef0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9d14c9561d496f9ab15782b9d53f3ef0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 36
  2⤵
  - Program crash
  PID:1904

memory/1884-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download