4d11a3e8c1db47f63d9c75db15b410c6282dd612f563a0df2a605c279c19e7a0

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 16:46

Target

NEAS.2169dfb1f9fdd82d5e6e909724e16320.exe
Size

268KB
MD5

2169dfb1f9fdd82d5e6e909724e16320
SHA1

34020010a2aa8fe2fbb257002bcc40d87492211d
SHA256

4d11a3e8c1db47f63d9c75db15b410c6282dd612f563a0df2a605c279c19e7a0
SHA512

f1b7775f736fdc544281dee7629fd4eece0982b2e728aaacdef002cbf887b7eee4c79f54dd4e6303b897df6b21695da8e5305f6e714948145af9f375c8f80988
SSDEEP

1536:hX6hYumWaZB1eq8C7tyBl1RUC37Xm1LjXq+66DFUABABOVLefE:V9CaZGq8Cux37ILj6+JB8M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	2732	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2872	2732	NEAS.2169dfb1f9fdd82d5e6e909724e16320.exe	28
PID 2732 wrote to memory of 2872	2732	NEAS.2169dfb1f9fdd82d5e6e909724e16320.exe	28
PID 2732 wrote to memory of 2872	2732	NEAS.2169dfb1f9fdd82d5e6e909724e16320.exe	28
PID 2732 wrote to memory of 2872	2732	NEAS.2169dfb1f9fdd82d5e6e909724e16320.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2169dfb1f9fdd82d5e6e909724e16320.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2169dfb1f9fdd82d5e6e909724e16320.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 36
  2⤵
  - Program crash
  PID:2872

memory/2732-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download