6943f2c4abf9f4f20afcf793a42474aa0dad0f9b2b71b96a1ab9c7d5578c077e

Analysis

max time kernel
158s
max time network
139s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 08:04

Target

NEAS.0366288a5cc911a047ae5fba1805c290.exe
Size

54KB
MD5

0366288a5cc911a047ae5fba1805c290
SHA1

6539d78c48c31dbe6484189ebb2ba1204665492d
SHA256

6943f2c4abf9f4f20afcf793a42474aa0dad0f9b2b71b96a1ab9c7d5578c077e
SHA512

bb0e2ec34f322f9784c2a8337b831be448ccefa882149a6160f702a915bf49acece5ecda574f908e212b085b45d18669afa0fa856526aae43e0b7f16852580e5
SSDEEP

1536:KxE1+vQTCwywoKxf5n2ThA3+RNexPnyAqTnfnd:d1+vICpwV5n2ThWsNexPnCrnd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1584	2488	WerFault.exe	2

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1584	2488	NEAS.0366288a5cc911a047ae5fba1805c290.exe	27
PID 2488 wrote to memory of 1584	2488	NEAS.0366288a5cc911a047ae5fba1805c290.exe	27
PID 2488 wrote to memory of 1584	2488	NEAS.0366288a5cc911a047ae5fba1805c290.exe	27
PID 2488 wrote to memory of 1584	2488	NEAS.0366288a5cc911a047ae5fba1805c290.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.0366288a5cc911a047ae5fba1805c290.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0366288a5cc911a047ae5fba1805c290.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 92
  2⤵
  - Program crash
  PID:1584

memory/2488-0-0x0000000000400000-0x000000000040335C-memory.dmp

Filesize
12KB

Download
memory/2488-1-0x0000000000400000-0x000000000040335C-memory.dmp

Filesize
12KB

Download