282fa3ec42c84863e54bc755acb5d4cb5e627d02b3902a94303f2d7521513f2f

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
03-11-2023 20:42

Target

NEAS.c7f9b14792768aa15b5cc25871d3d340_JC.exe
Size

472KB
MD5

c7f9b14792768aa15b5cc25871d3d340
SHA1

89e5167dbb1ca863a37f0838d914b5cdf8495215
SHA256

282fa3ec42c84863e54bc755acb5d4cb5e627d02b3902a94303f2d7521513f2f
SHA512

bf24e3180497d29e78e28a2e7ec1d12b7f25b99e95aae8ae920e02b6c1b160512e9a39aaa63d20e6b429d655b6d8130f2f6edb0461c7297ebe4446fc45a1d68d
SSDEEP

3072:4a8RinudiP52xx67lLdqiHDoMFWFT+QwmSwCYO5pmPar7d8bkzoziH:4XkgiPA6RcPMFWFSP9+bmkiH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2928	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2988	2928	NEAS.c7f9b14792768aa15b5cc25871d3d340_JC.exe	28
PID 2928 wrote to memory of 2988	2928	NEAS.c7f9b14792768aa15b5cc25871d3d340_JC.exe	28
PID 2928 wrote to memory of 2988	2928	NEAS.c7f9b14792768aa15b5cc25871d3d340_JC.exe	28
PID 2928 wrote to memory of 2988	2928	NEAS.c7f9b14792768aa15b5cc25871d3d340_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.c7f9b14792768aa15b5cc25871d3d340_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c7f9b14792768aa15b5cc25871d3d340_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 36
  2⤵
  - Program crash
  PID:2988

memory/2928-1-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download