626694c1e59384273611b9b479a65389e7de472e540d8fd0ded6fd813386c9b1

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 12:13

Target

NEAS.009537e3f161030b8603b1f0d7652480.exe
Size

96KB
MD5

009537e3f161030b8603b1f0d7652480
SHA1

68c55ff9a05ecbfb78f21e9ffac03d6eea7f0de3
SHA256

626694c1e59384273611b9b479a65389e7de472e540d8fd0ded6fd813386c9b1
SHA512

abb34ffdc2938a46d238b5c85432943ea347f4a0383a8fc4fce7ce4b21f9de18d0e11662cb3b0dffe11b1733e1f0c97a6d0b60a6fa38a2ade687195d65fedb4d
SSDEEP

1536:BwxgeoOBTuMQooaDkCg3SY+A37feaCMJDmYsLIb4PvYqHB/AdGN:Bwx1FBKIkCcSDADeak7dJHB/AdGN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	2888	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1448	2888	NEAS.009537e3f161030b8603b1f0d7652480.exe	27
PID 2888 wrote to memory of 1448	2888	NEAS.009537e3f161030b8603b1f0d7652480.exe	27
PID 2888 wrote to memory of 1448	2888	NEAS.009537e3f161030b8603b1f0d7652480.exe	27
PID 2888 wrote to memory of 1448	2888	NEAS.009537e3f161030b8603b1f0d7652480.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.009537e3f161030b8603b1f0d7652480.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.009537e3f161030b8603b1f0d7652480.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 148
  2⤵
  - Program crash
  PID:1448

memory/2888-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2888-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download