293f2173a9296c00cd57863472d0a1a2acf6be986f608ae4c4023c24850d4597

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 20:47

Target

NEAS.17f8c4b4baca61b7b650ee6f3a03ffa0.exe
Size

232KB
MD5

17f8c4b4baca61b7b650ee6f3a03ffa0
SHA1

d318367e0023c82c4d7e2d07fc8e77f7de5c75ea
SHA256

293f2173a9296c00cd57863472d0a1a2acf6be986f608ae4c4023c24850d4597
SHA512

bef5cc691905232973801732615bad5f208e7ae0b8d5851dec511c3c4375a545c48cfc10643f1374a75f617b5fce9ce4f671ae39d952b53c60ef8358f0e77efb
SSDEEP

768:A0XxuGVFdkNZwQAz8np7WFm2yORsr60iHl1xIugOi90dFkRv4izGk4e2p/1H5w2R:DxdkDk8n9RD+1rgOlkRXzP2LjAMt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	1408	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2864	1408	NEAS.17f8c4b4baca61b7b650ee6f3a03ffa0.exe	28
PID 1408 wrote to memory of 2864	1408	NEAS.17f8c4b4baca61b7b650ee6f3a03ffa0.exe	28
PID 1408 wrote to memory of 2864	1408	NEAS.17f8c4b4baca61b7b650ee6f3a03ffa0.exe	28
PID 1408 wrote to memory of 2864	1408	NEAS.17f8c4b4baca61b7b650ee6f3a03ffa0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.17f8c4b4baca61b7b650ee6f3a03ffa0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.17f8c4b4baca61b7b650ee6f3a03ffa0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 36
  2⤵
  - Program crash
  PID:2864

memory/1408-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download