f18e47a912b2b62771bc2b2bcbbe1bf3b3446dc6a26cf8182caf109b310dae52

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 17:35

Target

NEAS.2247ac49d4cb25a062182061eddaa26c.exe
Size

2.8MB
MD5

2247ac49d4cb25a062182061eddaa26c
SHA1

bb94fb7c79620b93e2d8ec18232b48a6c6863188
SHA256

f18e47a912b2b62771bc2b2bcbbe1bf3b3446dc6a26cf8182caf109b310dae52
SHA512

f7930c3c82a7d223264623d86442f5ba9c895b1a71debeec1c60695db16972cbc06cff926992cf5fb9ae1973d12fe2a5e85404934a333e2c2e26e618a8137232
SSDEEP

3072:vxS78Eu6RzLxK7IMsv38AuxfEGz5tEAX0eP2yCuvPIopzqt2onDPMS0veJu:vY9LxK/Y3kxfBz5t9XJJ53z3TLwu

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
2928	NEAS.2247ac49d4cb25a062182061eddaa26c.exe
2928	NEAS.2247ac49d4cb25a062182061eddaa26c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	2928	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2936	2928	NEAS.2247ac49d4cb25a062182061eddaa26c.exe	28
PID 2928 wrote to memory of 2936	2928	NEAS.2247ac49d4cb25a062182061eddaa26c.exe	28
PID 2928 wrote to memory of 2936	2928	NEAS.2247ac49d4cb25a062182061eddaa26c.exe	28
PID 2928 wrote to memory of 2936	2928	NEAS.2247ac49d4cb25a062182061eddaa26c.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2247ac49d4cb25a062182061eddaa26c.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2247ac49d4cb25a062182061eddaa26c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 200
  2⤵
  - Program crash
  PID:2936

\Users\Admin\AppData\Local\Temp\HAQTPVRHQ.exe

Filesize
3.0MB

MD5
82f06ec2a6a2c3e42c951b749a28c43f

SHA1
7b08ea2f252d75e9476fd778e10b97311cd3fef3

SHA256
523c4336f300599f63def8274c82d88c946ef78940e675b07eb6c1fb6f4ca5e5

SHA512
4d10b0f0b943c6e9562d3f5d4a2557814a881e54f19cac0f9ae9ecdf2a3fb9775b30095e195a85bc9361698e4dd349b4a223d1cb141c4f4f3587fbcf9f17d8ae

Download Submit
\Users\Admin\AppData\Local\Temp\HAQTPVRHQ.exe

Filesize
3.0MB

MD5
82f06ec2a6a2c3e42c951b749a28c43f

SHA1
7b08ea2f252d75e9476fd778e10b97311cd3fef3

SHA256
523c4336f300599f63def8274c82d88c946ef78940e675b07eb6c1fb6f4ca5e5

SHA512
4d10b0f0b943c6e9562d3f5d4a2557814a881e54f19cac0f9ae9ecdf2a3fb9775b30095e195a85bc9361698e4dd349b4a223d1cb141c4f4f3587fbcf9f17d8ae

Download Submit