b0258ae3365ceca0393365ecbe8990ca5f6ec2b59702a87827cf491fe5f0fe13

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 08:56

Target

NEAS.f3d21c00ecdd5836829dd0d86706a890.exe
Size

208KB
MD5

f3d21c00ecdd5836829dd0d86706a890
SHA1

3f840462555016497c2d63b91a8827f0ad6aebde
SHA256

b0258ae3365ceca0393365ecbe8990ca5f6ec2b59702a87827cf491fe5f0fe13
SHA512

2e6445119123bfccc97aaa3b917d214d0e30e50a91280af49b545bb08225ee5c0c02db202446a21b6504df8b2a153d2b1ebda6f2accaac81855918885d43d103
SSDEEP

1536:noAoXt/9zYsLS1zk+/0z4LBkx0LDTdk2N9wQWyfDX++DX:oAo9Vt21kEkUDvdTN9wSDzb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1660	2580	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1660	2580	NEAS.f3d21c00ecdd5836829dd0d86706a890.exe	20
PID 2580 wrote to memory of 1660	2580	NEAS.f3d21c00ecdd5836829dd0d86706a890.exe	20
PID 2580 wrote to memory of 1660	2580	NEAS.f3d21c00ecdd5836829dd0d86706a890.exe	20
PID 2580 wrote to memory of 1660	2580	NEAS.f3d21c00ecdd5836829dd0d86706a890.exe	20

C:\Users\Admin\AppData\Local\Temp\NEAS.f3d21c00ecdd5836829dd0d86706a890.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f3d21c00ecdd5836829dd0d86706a890.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 36
  2⤵
  - Program crash
  PID:1660

memory/2580-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download