8f26dfcd491226a9eeead1ebae7c3f664b4896aa0df4c2c15ccb766c3e2bdf8b

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 14:43

Target

NEAS.4df0333ad039ead4a4f30098a9603620.exe
Size

264KB
MD5

4df0333ad039ead4a4f30098a9603620
SHA1

3cb19ff5ef47de82acfba3325313aba219dbc8f2
SHA256

8f26dfcd491226a9eeead1ebae7c3f664b4896aa0df4c2c15ccb766c3e2bdf8b
SHA512

98c95c5a8af369cf8d90ad5b55b06008321bc50ccb0473d03942a1dc94442033fa84463dfb1c410095ed8b85eaa1d3f83c700e7ced72605bbd64e1ecc6a3bd3f
SSDEEP

3072:SC6xRyfFP0o35cc+rpdOSzbuE+h3+rJM++SYSUZCbCd:SC6xRydsS+XfyEcAJN+SYSUZCb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2280	2948	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2280	2948	NEAS.4df0333ad039ead4a4f30098a9603620.exe	28
PID 2948 wrote to memory of 2280	2948	NEAS.4df0333ad039ead4a4f30098a9603620.exe	28
PID 2948 wrote to memory of 2280	2948	NEAS.4df0333ad039ead4a4f30098a9603620.exe	28
PID 2948 wrote to memory of 2280	2948	NEAS.4df0333ad039ead4a4f30098a9603620.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.4df0333ad039ead4a4f30098a9603620.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4df0333ad039ead4a4f30098a9603620.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 36
  2⤵
  - Program crash
  PID:2280

memory/2948-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download