33529580cb2fe1a0a429fa387dc0bc92728f3e638a2c70496af0968cd02c4be0

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 06:05

Target

NEAS.a892cc2d4b52648196d73e206c4af200.exe
Size

272KB
MD5

a892cc2d4b52648196d73e206c4af200
SHA1

546bdc47942507af944ef7bc32893f798b057ccd
SHA256

33529580cb2fe1a0a429fa387dc0bc92728f3e638a2c70496af0968cd02c4be0
SHA512

5b0a07b02a756ea1b9b744b9c3390412adf234384e6fcf03d9d16509a43ce126873edd09a2cd47bac71d557769a46d2937b001273cd9c702dd3553230f17823a
SSDEEP

768:ASBQEeKKMVgw9+aHrTDs9EAak7tUyW1cLRyRJ/4hFxrn:HK4bkuTzMY2LMkXxr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	2152	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2532	2152	NEAS.a892cc2d4b52648196d73e206c4af200.exe	28
PID 2152 wrote to memory of 2532	2152	NEAS.a892cc2d4b52648196d73e206c4af200.exe	28
PID 2152 wrote to memory of 2532	2152	NEAS.a892cc2d4b52648196d73e206c4af200.exe	28
PID 2152 wrote to memory of 2532	2152	NEAS.a892cc2d4b52648196d73e206c4af200.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.a892cc2d4b52648196d73e206c4af200.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.a892cc2d4b52648196d73e206c4af200.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 36
  2⤵
  - Program crash
  PID:2532

memory/2152-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download