22ab53d6f736a89dcea0cdb910e4ae3da82e47641ff744a0df506dbc4af18c38

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 05:43

Target

NEAS.abc476ec0cfac60714a1f886a476c440.exe
Size

260KB
MD5

abc476ec0cfac60714a1f886a476c440
SHA1

d0ce12d8afdaed69260b183d5a19d85edd7f3e76
SHA256

22ab53d6f736a89dcea0cdb910e4ae3da82e47641ff744a0df506dbc4af18c38
SHA512

f8660d1cdbfa35d61558f85e803fbbc1914195b25505df478b12cf1b3f195b7d21cd654d3be2b8c5c3ec46b9133abfdcb3b8d91701eb9fc717268d6ba0dd80eb
SSDEEP

1536:r/bYp/t2n0fte97R5jDMUq3SYBbl6ti6yf5oAnqDM+4yy:7etnf8bQP6tiCuq4cy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1816	2952	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 1816	2952	NEAS.abc476ec0cfac60714a1f886a476c440.exe	28
PID 2952 wrote to memory of 1816	2952	NEAS.abc476ec0cfac60714a1f886a476c440.exe	28
PID 2952 wrote to memory of 1816	2952	NEAS.abc476ec0cfac60714a1f886a476c440.exe	28
PID 2952 wrote to memory of 1816	2952	NEAS.abc476ec0cfac60714a1f886a476c440.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.abc476ec0cfac60714a1f886a476c440.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.abc476ec0cfac60714a1f886a476c440.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 36
  2⤵
  - Program crash
  PID:1816

memory/2952-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download