9b7335a2b6f5b6159ba6a577de32b5bed0a93fcb2984b806477725134fa677e0

Analysis

max time kernel
127s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 05:12

Target

NEAS.be53ca3d39198ee8411daf86b9445450.exe
Size

212KB
MD5

be53ca3d39198ee8411daf86b9445450
SHA1

bbcece60a7aa4f005a7012d275c7cc7c233b2822
SHA256

9b7335a2b6f5b6159ba6a577de32b5bed0a93fcb2984b806477725134fa677e0
SHA512

8bd64d524a086a7833645ee10c7fd1bb1dd546cfe3b972e0178de775f56215e2f37eefd35f0168b80524d5791384ac5195f676609daf37d09a2acda190e0bc22
SSDEEP

768:C6cPsAifwZJ0cZGUk6vJOBdhqm2PeaiBWJQek7i0U02p/1H5jzXdnh:1ccYH/Gnc+hmlJQekOT02Lr

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1648	1980	WerFault.exe	20
4580	1980	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1648	1980	NEAS.be53ca3d39198ee8411daf86b9445450.exe	92
PID 1980 wrote to memory of 1648	1980	NEAS.be53ca3d39198ee8411daf86b9445450.exe	92
PID 1980 wrote to memory of 1648	1980	NEAS.be53ca3d39198ee8411daf86b9445450.exe	92

C:\Users\Admin\AppData\Local\Temp\NEAS.be53ca3d39198ee8411daf86b9445450.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.be53ca3d39198ee8411daf86b9445450.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 224
  2⤵
  - Program crash
  PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 224
  2⤵
  - Program crash
  PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1980 -ip 1980
1⤵
PID:3540

memory/1980-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download