e415099505691f84b1e72de76c13a9a626f4dcb1827d30af803630388358313c

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 05:29

Target

NEAS.1037417e3436b92d04ce38e992456440.exe
Size

200KB
MD5

1037417e3436b92d04ce38e992456440
SHA1

983d657955bc75107d1759adce7752df644c28c8
SHA256

e415099505691f84b1e72de76c13a9a626f4dcb1827d30af803630388358313c
SHA512

99845e19f8359a07e6ae6ec2f354d2d373c0b26585a60c0189eb8ec47eb89e1092b08d0909bf1f7b93a2a1f220d80a263d656e0bfe0d93374e0ac011a5ae3e76
SSDEEP

768:VFDWwdZSPJ+DJfIGtx2ZLCjwOrfxpq+KaQFjZ/uncU7KWtzz/1H5:VF/YcDJgGtx2ZLIZpqBzFF2n1zB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2312	2840	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2312	2840	NEAS.1037417e3436b92d04ce38e992456440.exe	28
PID 2840 wrote to memory of 2312	2840	NEAS.1037417e3436b92d04ce38e992456440.exe	28
PID 2840 wrote to memory of 2312	2840	NEAS.1037417e3436b92d04ce38e992456440.exe	28
PID 2840 wrote to memory of 2312	2840	NEAS.1037417e3436b92d04ce38e992456440.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.1037417e3436b92d04ce38e992456440.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1037417e3436b92d04ce38e992456440.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 36
  2⤵
  - Program crash
  PID:2312

memory/2840-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download