9942dfddf162dd9a9c996ca4fb990c972f730a467f7e46f027582f10b3f8c398

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 13:16

Target

NEAS.0e34f915da3c1ff2c05d60dfbfe8f9f0.exe
Size

399KB
MD5

0e34f915da3c1ff2c05d60dfbfe8f9f0
SHA1

9f0cd0c31c5a8480fa7c6fc8da9f442f1854e742
SHA256

9942dfddf162dd9a9c996ca4fb990c972f730a467f7e46f027582f10b3f8c398
SHA512

267775ab6d9e5956c833fb311ee9d18a386852ddf2d2f8c40a4a6e9b02844ed3139d428eb0241eee4ea531160a24a0b9224900d705df933f0b5fc65243ea627c
SSDEEP

6144:4r4BYSeGGzB510Vkp++L0lpfQnyaL3skwKyPOb1ampNduD2Mlcl+zo0naGs:DBFeGGzb2OMLfQBpwKiOb1am8DrxPaGs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1920	1728	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1920	1728	NEAS.0e34f915da3c1ff2c05d60dfbfe8f9f0.exe	28
PID 1728 wrote to memory of 1920	1728	NEAS.0e34f915da3c1ff2c05d60dfbfe8f9f0.exe	28
PID 1728 wrote to memory of 1920	1728	NEAS.0e34f915da3c1ff2c05d60dfbfe8f9f0.exe	28
PID 1728 wrote to memory of 1920	1728	NEAS.0e34f915da3c1ff2c05d60dfbfe8f9f0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.0e34f915da3c1ff2c05d60dfbfe8f9f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0e34f915da3c1ff2c05d60dfbfe8f9f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 152
  2⤵
  - Program crash
  PID:1920

memory/1728-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1728-1-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download