17742bb705dc1d485375c25a8fb1ef7e3786bb4c10bc956aa02fe4c8d126b405

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 14:48

Target

NEAS.37b60ce766bda8cd83a78cccf6089fb0_JC.exe
Size

216KB
MD5

37b60ce766bda8cd83a78cccf6089fb0
SHA1

42d093bfd9795a31464e0029d4be770ebbe05b49
SHA256

17742bb705dc1d485375c25a8fb1ef7e3786bb4c10bc956aa02fe4c8d126b405
SHA512

357248d86874475dc7ebd3b4a5bef4f7d541279217ce1723cf78571b6eb2f351dce31e3371c3b00b5a1902f89c800a05c82c7e50e5e88e465b0aafbdece6258d
SSDEEP

1536:WnTBTcaYZCpPTJCzr49AfwvCypj0/GRQ1ReVWROVWR:0TuW1TJHA4Nne14WkW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	2496	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2508	2496	NEAS.37b60ce766bda8cd83a78cccf6089fb0_JC.exe	28
PID 2496 wrote to memory of 2508	2496	NEAS.37b60ce766bda8cd83a78cccf6089fb0_JC.exe	28
PID 2496 wrote to memory of 2508	2496	NEAS.37b60ce766bda8cd83a78cccf6089fb0_JC.exe	28
PID 2496 wrote to memory of 2508	2496	NEAS.37b60ce766bda8cd83a78cccf6089fb0_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.37b60ce766bda8cd83a78cccf6089fb0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.37b60ce766bda8cd83a78cccf6089fb0_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 36
  2⤵
  - Program crash
  PID:2508

memory/2496-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download