83609e2ef3e9f8468f884a01171aeca93d955d8f803492c163a9ddaf7283dbf2

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 05:00

Target

NEAS.0e5478c775aff8b99b8a49d2ef9f4db0.exe
Size

264KB
MD5

0e5478c775aff8b99b8a49d2ef9f4db0
SHA1

84ab599cb042e2786ebaf89ba0457114785c579a
SHA256

83609e2ef3e9f8468f884a01171aeca93d955d8f803492c163a9ddaf7283dbf2
SHA512

7c832a5fa5afe9c59edb1a591e7e5033a7c07ec769354e0ddea52d1e19ba9ed85a3d02d0b76bb9e8d765999502f4921f896c90360686d5bec573a09dd3ca4e11
SSDEEP

1536:dtUDRi9T5sJdi9bxHNr2pnx6KaUuP6iuwJRMqn:dt8RinudiP52xx67lLd4q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2552	1676	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2552	1676	NEAS.0e5478c775aff8b99b8a49d2ef9f4db0.exe	28
PID 1676 wrote to memory of 2552	1676	NEAS.0e5478c775aff8b99b8a49d2ef9f4db0.exe	28
PID 1676 wrote to memory of 2552	1676	NEAS.0e5478c775aff8b99b8a49d2ef9f4db0.exe	28
PID 1676 wrote to memory of 2552	1676	NEAS.0e5478c775aff8b99b8a49d2ef9f4db0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.0e5478c775aff8b99b8a49d2ef9f4db0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0e5478c775aff8b99b8a49d2ef9f4db0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 36
  2⤵
  - Program crash
  PID:2552

memory/1676-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download