1ee71348ffd215de1549e16875cdb0b33f294c58c72a5e3c39326db9185cfdd5

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 18:34

Target

NEAS.258edc6f7bc88dd3268f3f223653bd00.exe
Size

410KB
MD5

258edc6f7bc88dd3268f3f223653bd00
SHA1

77523da75e4a4893c326c49742d2eda5f2cc686e
SHA256

1ee71348ffd215de1549e16875cdb0b33f294c58c72a5e3c39326db9185cfdd5
SHA512

255be6486e7f85a04ec4c633729659b8ff1bcc68cb4d438e207474f36481dae9a1906b2bf8b536540c08dda07839798c482d7160dd8273a0cafb6aeaeb74b29f
SSDEEP

384:XJ6wayA+1mwnA353BXR+oGfPmfm4MlcTGXdhjwroyY2rebV5O6KhdWb/83BXR+oc:ZpQNwC3BESe4Vqth+0V5vKUE3BEJwRrM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2620	2000	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2620	2000	NEAS.258edc6f7bc88dd3268f3f223653bd00.exe	28
PID 2000 wrote to memory of 2620	2000	NEAS.258edc6f7bc88dd3268f3f223653bd00.exe	28
PID 2000 wrote to memory of 2620	2000	NEAS.258edc6f7bc88dd3268f3f223653bd00.exe	28
PID 2000 wrote to memory of 2620	2000	NEAS.258edc6f7bc88dd3268f3f223653bd00.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.258edc6f7bc88dd3268f3f223653bd00.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.258edc6f7bc88dd3268f3f223653bd00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 36
  2⤵
  - Program crash
  PID:2620