d9807081db87e019d1a7f85355ef218d80c826481485791e299ee85892bea585

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 16:27

Target

NEAS.dd53ae5ae0982b187c1b018291f24b20.exe
Size

412KB
MD5

dd53ae5ae0982b187c1b018291f24b20
SHA1

a427e6421cfb68009245baaa6b558db5236f9ee1
SHA256

d9807081db87e019d1a7f85355ef218d80c826481485791e299ee85892bea585
SHA512

97b768a9f05ae28da3f1962dd4afb2c207e6bd80737b9b5adbb40947e4d843e159e1e04a051c8bbe963cecdca11a3858336d7544cbfa8e02dc8d6e7cda2545d4
SSDEEP

3072:dYt7QefKNMVGVpVFbcohtEtdO2d4EVdYay4dH:+t7QetVGHLcoLcdO2dbYabH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	2624	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2912	2624	NEAS.dd53ae5ae0982b187c1b018291f24b20.exe	28
PID 2624 wrote to memory of 2912	2624	NEAS.dd53ae5ae0982b187c1b018291f24b20.exe	28
PID 2624 wrote to memory of 2912	2624	NEAS.dd53ae5ae0982b187c1b018291f24b20.exe	28
PID 2624 wrote to memory of 2912	2624	NEAS.dd53ae5ae0982b187c1b018291f24b20.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.dd53ae5ae0982b187c1b018291f24b20.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.dd53ae5ae0982b187c1b018291f24b20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 36
  2⤵
  - Program crash
  PID:2912

memory/2624-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2624-1-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download