0f8cf95267a5454dcc5030acc3266453242cea6a72340f11d7d20ac6fead8dd1

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 05:05

Target

NEAS.acb76151ecb3286fd088cfa7ed1ffc50.exe
Size

208KB
MD5

acb76151ecb3286fd088cfa7ed1ffc50
SHA1

3d057c08df7196cb253595ef0eff9e7123aea969
SHA256

0f8cf95267a5454dcc5030acc3266453242cea6a72340f11d7d20ac6fead8dd1
SHA512

16cfa6a58758e9772dff8edf0465d3129700435d0f684f94cf00f4eceaf95ad7e2de1646c47304f2988e27910225200c780b7a71e95b858fca0919269e31e385
SSDEEP

768:itrMVtrM4uimFjj49Nd9ng6PNkyDMQAa+1895t4b9k122ftSJP9rVY3GXf92Ep6W:w2B6Fjjm7Pu189OkMRP9R8GX12jCL

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1200-1-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2444	1200	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2444	1200	NEAS.acb76151ecb3286fd088cfa7ed1ffc50.exe	28
PID 1200 wrote to memory of 2444	1200	NEAS.acb76151ecb3286fd088cfa7ed1ffc50.exe	28
PID 1200 wrote to memory of 2444	1200	NEAS.acb76151ecb3286fd088cfa7ed1ffc50.exe	28
PID 1200 wrote to memory of 2444	1200	NEAS.acb76151ecb3286fd088cfa7ed1ffc50.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.acb76151ecb3286fd088cfa7ed1ffc50.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.acb76151ecb3286fd088cfa7ed1ffc50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 36
  2⤵
  - Program crash
  PID:2444

memory/1200-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download