c7447155243879459a5c32fe6400548b3bd8faefa008a236bcef4effa1539a32

Analysis

max time kernel
119s
max time network
145s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 08:05

Target

NEAS.7c8b0d9dca8425b2702fd02cce795530.exe
Size

236KB
MD5

7c8b0d9dca8425b2702fd02cce795530
SHA1

87f28aa5b41f9cca9537046a2488a2a0a0cc9f48
SHA256

c7447155243879459a5c32fe6400548b3bd8faefa008a236bcef4effa1539a32
SHA512

6d08d8e3227bd3c19ab1082d9f251bd427dfe42e48c5e0040deea82bcaa5b4cefbf0480fc592cdd4a47f363b2a284edc90ecd03d4082172ed2131ea63b476ac0
SSDEEP

1536:UXkZqnQM2U13s0s75Fvv7nG8TQzO/dHiQhQjILQ9FKGXl:UXkZy180sVt7nG8+9Q4KG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2616	3028	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2616	3028	NEAS.7c8b0d9dca8425b2702fd02cce795530.exe	29
PID 3028 wrote to memory of 2616	3028	NEAS.7c8b0d9dca8425b2702fd02cce795530.exe	29
PID 3028 wrote to memory of 2616	3028	NEAS.7c8b0d9dca8425b2702fd02cce795530.exe	29
PID 3028 wrote to memory of 2616	3028	NEAS.7c8b0d9dca8425b2702fd02cce795530.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.7c8b0d9dca8425b2702fd02cce795530.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7c8b0d9dca8425b2702fd02cce795530.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 36
  2⤵
  - Program crash
  PID:2616

memory/3028-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download