b81a165f6eb73d4d12377558a946c68cebdd2c536b6df19e017ee88e3291dbe8

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 14:27

Target

NEAS.ac15a53142255c25bcb250b83084c110.exe
Size

188KB
MD5

ac15a53142255c25bcb250b83084c110
SHA1

26669c302f694f70db54d7bb37f7f1bad48b0e0b
SHA256

b81a165f6eb73d4d12377558a946c68cebdd2c536b6df19e017ee88e3291dbe8
SHA512

d8649e9cb1f80f850c644644436a1b607cc8d22e8d27525ffbb1cba5cf834d8cfa701cc640f8eee41e09c79747037b240a30b7babb8fd1d4eeac7e0f0595ad53
SSDEEP

768:tEA+elap4nNM8+R6N5HzHa86fsWC/WVrMZZ8L/1H5:t7+eltm8Y6jHO86s/WVSy9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	1936	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2224	1936	NEAS.ac15a53142255c25bcb250b83084c110.exe	27
PID 1936 wrote to memory of 2224	1936	NEAS.ac15a53142255c25bcb250b83084c110.exe	27
PID 1936 wrote to memory of 2224	1936	NEAS.ac15a53142255c25bcb250b83084c110.exe	27
PID 1936 wrote to memory of 2224	1936	NEAS.ac15a53142255c25bcb250b83084c110.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.ac15a53142255c25bcb250b83084c110.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ac15a53142255c25bcb250b83084c110.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 36
  2⤵
  - Program crash
  PID:2224

memory/1936-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download