0dd0f7472fe995f0a00dad4d31de2fa4ab28622289c91d921cac17a9eb469200

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 17:20

Target

NEAS.d0de81a45f3514f52199b7494537fbf0.exe
Size

472KB
MD5

d0de81a45f3514f52199b7494537fbf0
SHA1

7ab68bc263c3979bb6f93f94c9523b710cdd90cb
SHA256

0dd0f7472fe995f0a00dad4d31de2fa4ab28622289c91d921cac17a9eb469200
SHA512

cdbb83c4eb0ba663959c089d615c236918ed831d13f555f9fe27bc34afc7b2b625a404b16a3362a6cf3e7256d726beb60e92d3f7d9f74e76d37f72ea7feb54d6
SSDEEP

3072:I8RinudiP52xx67lLdziHDonP/sOw9UPFM3n88b5arIpn:9kgiPA6RlPXsSGroK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	2292	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2160	2292	NEAS.d0de81a45f3514f52199b7494537fbf0.exe	28
PID 2292 wrote to memory of 2160	2292	NEAS.d0de81a45f3514f52199b7494537fbf0.exe	28
PID 2292 wrote to memory of 2160	2292	NEAS.d0de81a45f3514f52199b7494537fbf0.exe	28
PID 2292 wrote to memory of 2160	2292	NEAS.d0de81a45f3514f52199b7494537fbf0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.d0de81a45f3514f52199b7494537fbf0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d0de81a45f3514f52199b7494537fbf0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 36
  2⤵
  - Program crash
  PID:2160

memory/2292-1-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download