c6357b69f1029c605adbabecca684ccbf0f4fab515abe1c57be1da8074d0d241

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
05-11-2023 20:28

Target

NEAS.00a9187695edbcca6b0421c72d5338d0.exe
Size

320KB
MD5

00a9187695edbcca6b0421c72d5338d0
SHA1

8ea6f68633e61f3b1158889492f991eeea5c9728
SHA256

c6357b69f1029c605adbabecca684ccbf0f4fab515abe1c57be1da8074d0d241
SHA512

e27488b90eb79bb2646bb20e92090e49eada30ef36e6af4c05f4f800cb440ad7b7aa71e76b4396b4153a9f0e1ead7c67ffcb3f10d6bc43e511e6aa8256ff51fc
SSDEEP

6144:s3liHW522H2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:s3l2q2s2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	2988	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2836	2988	NEAS.00a9187695edbcca6b0421c72d5338d0.exe	28
PID 2988 wrote to memory of 2836	2988	NEAS.00a9187695edbcca6b0421c72d5338d0.exe	28
PID 2988 wrote to memory of 2836	2988	NEAS.00a9187695edbcca6b0421c72d5338d0.exe	28
PID 2988 wrote to memory of 2836	2988	NEAS.00a9187695edbcca6b0421c72d5338d0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.00a9187695edbcca6b0421c72d5338d0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.00a9187695edbcca6b0421c72d5338d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 36
  2⤵
  - Program crash
  PID:2836

memory/2988-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2988-1-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download