4169fb7fb88b42af3888dbfe2ef44bebbdf178535adacd590aed283ebc242842

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 17:12

Target

NEAS.d5edbacf5f761a00240b661bd104fb20.exe
Size

268KB
MD5

d5edbacf5f761a00240b661bd104fb20
SHA1

373bea9d0f50caba0587dd4481dedeb17d34b2ee
SHA256

4169fb7fb88b42af3888dbfe2ef44bebbdf178535adacd590aed283ebc242842
SHA512

ffcfcaec06d2a28eb051f3e3625f9f7faa15ee1ba033aa0e757cccac1f0b146aa2d04809276026b38bdfeaa0beaab5b462781445cc522a16b46b389c83120ac4
SSDEEP

1536:Ec1/v71lrRQfEMsysTg7QzMW6FaD4SjXq+66DFUABABOVLefE:51H7HRQFshr6w4Sj6+JB8M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	2060	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3056	2060	NEAS.d5edbacf5f761a00240b661bd104fb20.exe	28
PID 2060 wrote to memory of 3056	2060	NEAS.d5edbacf5f761a00240b661bd104fb20.exe	28
PID 2060 wrote to memory of 3056	2060	NEAS.d5edbacf5f761a00240b661bd104fb20.exe	28
PID 2060 wrote to memory of 3056	2060	NEAS.d5edbacf5f761a00240b661bd104fb20.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.d5edbacf5f761a00240b661bd104fb20.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d5edbacf5f761a00240b661bd104fb20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 36
  2⤵
  - Program crash
  PID:3056

memory/2060-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download