cafddef2c90d8a4979c15f063a0c2852801ed1c5ce058872440c592e1273797f

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 15:48

Target

NEAS.608bfb3555a6ab3e9cbfc64f2a0ff760.exe
Size

228KB
MD5

608bfb3555a6ab3e9cbfc64f2a0ff760
SHA1

35edbc9c18fc80be9d2fd6dd57b493aed390413f
SHA256

cafddef2c90d8a4979c15f063a0c2852801ed1c5ce058872440c592e1273797f
SHA512

d3098788341f793b2064fefa0833db14b7062b847853aaf8f8ab02b88bfcd4317d5aa62646ce5b4b0686d15627dcf677f88911891e20bf0267f71170544a8571
SSDEEP

768:f1DC1LCP89xeW22keTuGJewSnERidcOsvrzCS8AvbuO90hiUi9I/1H5tTXdnhguR:9lk9xeAuY/Ieidif+3uzEbRfpol

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1168	2116	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1168	2116	NEAS.608bfb3555a6ab3e9cbfc64f2a0ff760.exe	28
PID 2116 wrote to memory of 1168	2116	NEAS.608bfb3555a6ab3e9cbfc64f2a0ff760.exe	28
PID 2116 wrote to memory of 1168	2116	NEAS.608bfb3555a6ab3e9cbfc64f2a0ff760.exe	28
PID 2116 wrote to memory of 1168	2116	NEAS.608bfb3555a6ab3e9cbfc64f2a0ff760.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.608bfb3555a6ab3e9cbfc64f2a0ff760.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.608bfb3555a6ab3e9cbfc64f2a0ff760.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 36
  2⤵
  - Program crash
  PID:1168

memory/2116-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download