e6d6cf975e6bb271000aa78f8692b17eb730bf96d175a437c1fc3723efcf243c

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12-11-2023 23:41

Target

NEAS.481f1f4e3368b6af54b216da5ed12610.exe
Size

72KB
MD5

481f1f4e3368b6af54b216da5ed12610
SHA1

06a99a21cfa2b1131a534c5b84fc81694a589cfa
SHA256

e6d6cf975e6bb271000aa78f8692b17eb730bf96d175a437c1fc3723efcf243c
SHA512

4a834805e42fe8e2428c27317f08b9a9f3d1766ed7da61a02230c108b53790806f1e9f666ac933f1c9f3af334cac12cd23d9d96bdd2584e43fe82b6d2411cb81
SSDEEP

384:XJ6wayA+1mwnA353BXR+oGfPmfm4MlcTGXdhjwroyY2rebV5O6KhdWb/83BXR+oX:ZpQNwC3BESe4Vqth+0V5vKUE3BEJwRrn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	2428	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2260	2428	NEAS.481f1f4e3368b6af54b216da5ed12610.exe	28
PID 2428 wrote to memory of 2260	2428	NEAS.481f1f4e3368b6af54b216da5ed12610.exe	28
PID 2428 wrote to memory of 2260	2428	NEAS.481f1f4e3368b6af54b216da5ed12610.exe	28
PID 2428 wrote to memory of 2260	2428	NEAS.481f1f4e3368b6af54b216da5ed12610.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.481f1f4e3368b6af54b216da5ed12610.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.481f1f4e3368b6af54b216da5ed12610.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 36
  2⤵
  - Program crash
  PID:2260