03763439eed529321f26f046ad9bd656e5714118528e59abab271fd8c1d889d3

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 16:02

Target

NEAS.f45b4c4a65ee4252c9fe31000156f0c0.exe
Size

252KB
MD5

f45b4c4a65ee4252c9fe31000156f0c0
SHA1

dbc3cdef63ee34927faaaccaa92e1e3079e76a62
SHA256

03763439eed529321f26f046ad9bd656e5714118528e59abab271fd8c1d889d3
SHA512

eb7eab71dd50078acd6ffdfc0dce9ba15fb63699d48d5698ad84c32283cae7891b0f35b55dc3a6d03289d5b2fa922bf0f23f8958e8171d99f7c027e797aa8809
SSDEEP

6144:nFn95lJdZFnVR95lhNJ1xdZFBtpVR95lhNJ1xdZFBtpVR95lhNJ1xdBtquSW6+i8:nFWNi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1688	2176	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1688	2176	NEAS.f45b4c4a65ee4252c9fe31000156f0c0.exe	28
PID 2176 wrote to memory of 1688	2176	NEAS.f45b4c4a65ee4252c9fe31000156f0c0.exe	28
PID 2176 wrote to memory of 1688	2176	NEAS.f45b4c4a65ee4252c9fe31000156f0c0.exe	28
PID 2176 wrote to memory of 1688	2176	NEAS.f45b4c4a65ee4252c9fe31000156f0c0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.f45b4c4a65ee4252c9fe31000156f0c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f45b4c4a65ee4252c9fe31000156f0c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 36
  2⤵
  - Program crash
  PID:1688

memory/2176-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download