bb980afc2395317735c687debc017d75f275c923308a4f040ed9fae953d4e962

Analysis

max time kernel
48s
max time network
25s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 11:57

Target

NEAS.71e85f2554cdd7852f8c0883dbf679e0.exe
Size

204KB
MD5

71e85f2554cdd7852f8c0883dbf679e0
SHA1

fa7a17d2f8aeaca185692285e5537bf32d1b39be
SHA256

bb980afc2395317735c687debc017d75f275c923308a4f040ed9fae953d4e962
SHA512

9f12fc6b3ececbc469c89894023cc99e787f7264bfc60696c774f5ca22190a5014c4218c3c1ae3c9f9f8aaec77492f39e6de0f5f9d4f1e44befc55d72e37c31f
SSDEEP

768:YDApAJmxwUh6zO5g7Wfb8BvTRbdUE6Sijv7xCIwxNjX/1H5siXdnhg:asASwKScoNSLDhCt9KI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	2600	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2712	2600	NEAS.71e85f2554cdd7852f8c0883dbf679e0.exe	29
PID 2600 wrote to memory of 2712	2600	NEAS.71e85f2554cdd7852f8c0883dbf679e0.exe	29
PID 2600 wrote to memory of 2712	2600	NEAS.71e85f2554cdd7852f8c0883dbf679e0.exe	29
PID 2600 wrote to memory of 2712	2600	NEAS.71e85f2554cdd7852f8c0883dbf679e0.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.71e85f2554cdd7852f8c0883dbf679e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.71e85f2554cdd7852f8c0883dbf679e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 36
  2⤵
  - Program crash
  PID:2712

memory/2600-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download