dd9b3a905fbb0ab3e7ec35b6fe82e89da5bbb1e9a59831f41820af9e7ef3b163

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 08:42

Target
NEAS.0124afa6554056e15bbe147ecba471c0.exe
Size 208KB
Sample231104-kl1lqaeb3s
SHA256 dd9b3a905fbb0ab3e7ec35b6fe82e89da5bbb1e9a59831f41820af9e7ef3b163
MD5 0124afa6554056e15bbe147ecba471c0
SHA1 2d446f0fc78ee88d0bcaa49f6a6c8dc7c575b188
SHA512 c3fb5862add07b94fe47c4ddc299d4e9bb29e7afd865a5fc74cf147599fe0ece7877cf76030e5bd584db0e057315f37d1b4c6293206eba2251ee14f25fb00f03
SSDEEP 1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yc:f0OtF2Qo7VsJgisxlYegEX0ZZbW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3796	2888	WerFault.exe	86

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2888	NEAS.0124afa6554056e15bbe147ecba471c0.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.0124afa6554056e15bbe147ecba471c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0124afa6554056e15bbe147ecba471c0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 464
  2⤵
  - Program crash
  PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2888 -ip 2888
1⤵
PID:3472

memory/2888-2-0x0000000002120000-0x0000000002121000-memory.dmp

Download

memory/2888-3-0x0000000002160000-0x0000000002161000-memory.dmp

Download