99e61080dcbfa6e5fccec58b289a3437b13901a63f16b4cef371a18eb99006a0

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 17:56

Target

NEAS.d367f9337708f9b8276832eefa7edeb0.exe
Size

301KB
MD5

d367f9337708f9b8276832eefa7edeb0
SHA1

dc3c3b6676918235d145b073e90affee6c35e6b1
SHA256

99e61080dcbfa6e5fccec58b289a3437b13901a63f16b4cef371a18eb99006a0
SHA512

5b5d7856aa8c74dc058fa601950a460b9ce084d87a1b8d83a50fad5e70af6671559475f50eecc9dd78217f43dd28b6014ff116e3ffe3f5222e15ed4cb3e9824f
SSDEEP

6144:V619cEp0ZGwTV2qZcDJphestvyiucHU2fth8ZQtNopA:V65p0Z94q6Dom/7HUqtCZK1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	1940	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1952	1940	NEAS.d367f9337708f9b8276832eefa7edeb0.exe	29
PID 1940 wrote to memory of 1952	1940	NEAS.d367f9337708f9b8276832eefa7edeb0.exe	29
PID 1940 wrote to memory of 1952	1940	NEAS.d367f9337708f9b8276832eefa7edeb0.exe	29
PID 1940 wrote to memory of 1952	1940	NEAS.d367f9337708f9b8276832eefa7edeb0.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.d367f9337708f9b8276832eefa7edeb0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d367f9337708f9b8276832eefa7edeb0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 36
  2⤵
  - Program crash
  PID:1952

memory/1940-0-0x0000000000D70000-0x0000000000E11000-memory.dmp

Filesize
644KB

Download