d7e4417f6630a831a657cd74eee55c54818afa201a8e224e8ffd31ecdb12bfba

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 09:55

Target

NEAS.4ada4acd321b521bc437fcbcd3594070_JC.exe
Size

204KB
MD5

4ada4acd321b521bc437fcbcd3594070
SHA1

3e82017b4482ec3e406eac4747ba19fc4627ff50
SHA256

d7e4417f6630a831a657cd74eee55c54818afa201a8e224e8ffd31ecdb12bfba
SHA512

e88d365cbf509311f6d83c76e56e61093f453e30e3b46f5e99f2f817d0b41df8e2f8ff3581d696d37e7ab76610b9f0c474b0ca0e1d199094f423e9ba5eb13995
SSDEEP

768:+6as1TDGL1/PX2j3LbBTf5wDjG+9Q5GB9Lw7yCjy0cuQxuBG2p/1H5s10Xdnh:n1TW1/uLLdb50S+9Q5GLwLyVV2LX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2776	2952	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2776	2952	NEAS.4ada4acd321b521bc437fcbcd3594070_JC.exe	28
PID 2952 wrote to memory of 2776	2952	NEAS.4ada4acd321b521bc437fcbcd3594070_JC.exe	28
PID 2952 wrote to memory of 2776	2952	NEAS.4ada4acd321b521bc437fcbcd3594070_JC.exe	28
PID 2952 wrote to memory of 2776	2952	NEAS.4ada4acd321b521bc437fcbcd3594070_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.4ada4acd321b521bc437fcbcd3594070_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4ada4acd321b521bc437fcbcd3594070_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 36
  2⤵
  - Program crash
  PID:2776

memory/2952-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download