457e6192df492ab5e76e582b0e9660d031a86b0bbecb4be45e6d0f269476c8b5

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03-11-2023 09:56

Target

NEAS.ec91a6e8a400917d31c435e0a3525740.exe
Size

212KB
MD5

ec91a6e8a400917d31c435e0a3525740
SHA1

45e8c0a9866ea5b64bc131b00f0c85051a29c362
SHA256

457e6192df492ab5e76e582b0e9660d031a86b0bbecb4be45e6d0f269476c8b5
SHA512

0783133c30a11a14cab6d32f12e54108913e24e4e17868d3ab026c7bb039e263e9c49840b2a97041e731cb75fc6f58518d0e6bb5407bc82d7bc0951db5c74297
SSDEEP

768:hDApAJmxwUh6zO5g7Wfb8BvTRbdUE6Sijv7xCIcBijX/1H5nF0Xdnhg:BsASwKScoNSLDhmi9x8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	1836	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2040	1836	NEAS.ec91a6e8a400917d31c435e0a3525740.exe	28
PID 1836 wrote to memory of 2040	1836	NEAS.ec91a6e8a400917d31c435e0a3525740.exe	28
PID 1836 wrote to memory of 2040	1836	NEAS.ec91a6e8a400917d31c435e0a3525740.exe	28
PID 1836 wrote to memory of 2040	1836	NEAS.ec91a6e8a400917d31c435e0a3525740.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.ec91a6e8a400917d31c435e0a3525740.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ec91a6e8a400917d31c435e0a3525740.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 36
  2⤵
  - Program crash
  PID:2040

memory/1836-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download