3098b6e9705d1a9b58666dca0ebf87191adc7ec68bfe5e446b5d2c6a1089736d

Analysis

max time kernel
118s
max time network
158s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 11:15

Target

NEAS.7eac6b8ebcc4f2e2344d80b4009c9130.exe
Size

208KB
MD5

7eac6b8ebcc4f2e2344d80b4009c9130
SHA1

6d9a6212cc406769dd964bc42a059cf40ca0d7dd
SHA256

3098b6e9705d1a9b58666dca0ebf87191adc7ec68bfe5e446b5d2c6a1089736d
SHA512

bf10fe1274ddacbb90b2f88701a8e32039d136dc8d9af2651d59589ac1967bd9e1347d26a8855521b255a7ed59b89ace99aa7726c1bdfaa08c67fcde533e4931
SSDEEP

768:rmMeEXxR3F8UNvrJb0PztsYDpVLGc3HZWok/6pSy5kkyxrT/1H5XXdnh:rDzXF8CvrJ4PBhDP35RZAhj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2740	2700	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2740	2700	NEAS.7eac6b8ebcc4f2e2344d80b4009c9130.exe	29
PID 2700 wrote to memory of 2740	2700	NEAS.7eac6b8ebcc4f2e2344d80b4009c9130.exe	29
PID 2700 wrote to memory of 2740	2700	NEAS.7eac6b8ebcc4f2e2344d80b4009c9130.exe	29
PID 2700 wrote to memory of 2740	2700	NEAS.7eac6b8ebcc4f2e2344d80b4009c9130.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.7eac6b8ebcc4f2e2344d80b4009c9130.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7eac6b8ebcc4f2e2344d80b4009c9130.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 36
  2⤵
  - Program crash
  PID:2740

memory/2700-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download