9347baa18ae2bcbe1d29e883741b75c0c4690a4e467b033377bdd03631e20a50

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 19:51

Target

NEAS.7424b921aedebd4953ee96b35c21d630.exe
Size

204KB
MD5

7424b921aedebd4953ee96b35c21d630
SHA1

1c98cf51ef04554cf78f33139eb00e04558efbe8
SHA256

9347baa18ae2bcbe1d29e883741b75c0c4690a4e467b033377bdd03631e20a50
SHA512

81e01f41370ad4166eb8b14fa63fbde68475b299ec29cd587da9daaef43da504e80376607154673f8219bceca70b521e4360464f696802d9bd9effa9d511076e
SSDEEP

1536:m9UC6VP2+pq4K2f3iBHCnSp3CBLS4aK+eRFBa/N3RQ:fC6VPbzSHCniskOFE/N3e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2288	1888	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2288	1888	NEAS.7424b921aedebd4953ee96b35c21d630.exe	28
PID 1888 wrote to memory of 2288	1888	NEAS.7424b921aedebd4953ee96b35c21d630.exe	28
PID 1888 wrote to memory of 2288	1888	NEAS.7424b921aedebd4953ee96b35c21d630.exe	28
PID 1888 wrote to memory of 2288	1888	NEAS.7424b921aedebd4953ee96b35c21d630.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.7424b921aedebd4953ee96b35c21d630.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7424b921aedebd4953ee96b35c21d630.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 36
  2⤵
  - Program crash
  PID:2288

memory/1888-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download