1fa2e88917d13d4f351cceb43747f96394bd0e71444148b757b8c1f9bc173e67

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 05:35

Target

NEAS.a97334218bc0d24e2c45be4823ecd840.exe
Size

196KB
MD5

a97334218bc0d24e2c45be4823ecd840
SHA1

73b7864cd1f6653126ec000d3c23aab6d3dc17c2
SHA256

1fa2e88917d13d4f351cceb43747f96394bd0e71444148b757b8c1f9bc173e67
SHA512

f84592e3bd107bf7e735f12bdc7b4904a0e7f9b6b1a0b860056e994e8162fca19aceba00ce3e37ef6a25c534f110689a192215da9093953b16cf7a0a9f74bb9f
SSDEEP

768:XiEgY6+xEN0uFdweRDHHVxYUGrXpQCCcMmsowuQrJEcCUgYxoiJ1BFh/+Nn/1H5s:ez+ju0CzTwMuQrJEpLiJ1Br/+NN6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	1672	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2728	1672	NEAS.a97334218bc0d24e2c45be4823ecd840.exe	27
PID 1672 wrote to memory of 2728	1672	NEAS.a97334218bc0d24e2c45be4823ecd840.exe	27
PID 1672 wrote to memory of 2728	1672	NEAS.a97334218bc0d24e2c45be4823ecd840.exe	27
PID 1672 wrote to memory of 2728	1672	NEAS.a97334218bc0d24e2c45be4823ecd840.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.a97334218bc0d24e2c45be4823ecd840.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.a97334218bc0d24e2c45be4823ecd840.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 36
  2⤵
  - Program crash
  PID:2728

memory/1672-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download