f38f38bdd7b03865cb55a51f53c454db8cf4d60e3c489a282fe5dfc838f2ff24

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 20:22

Target

NEAS.0dd6b5daa6f560532e972bba3cf76e20.exe
Size

130KB
MD5

0dd6b5daa6f560532e972bba3cf76e20
SHA1

200e9c03857239ac9be163a9557bcb3b4ed6dce9
SHA256

f38f38bdd7b03865cb55a51f53c454db8cf4d60e3c489a282fe5dfc838f2ff24
SHA512

34d7ac0acfa6188922ef3038653e59037e26e47936d50a9aa0e5245ffe8080550abfc9df9d58a5a9ee3f23a6de86db9e1dd3b61f857b09a74eca98f3ab1f425d
SSDEEP

1536:/88trtAAQVf3SR8ep3ATtPou+y0M69n5NPFZ9affUsWLphtt5rvbzW9mn099NE3/:/dlMV5ep3ATtAuOMSNPFZ9affUsWo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2068	1748	NEAS.0dd6b5daa6f560532e972bba3cf76e20.exe	29
PID 1748 wrote to memory of 2068	1748	NEAS.0dd6b5daa6f560532e972bba3cf76e20.exe	29
PID 1748 wrote to memory of 2068	1748	NEAS.0dd6b5daa6f560532e972bba3cf76e20.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.0dd6b5daa6f560532e972bba3cf76e20.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0dd6b5daa6f560532e972bba3cf76e20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1748 -s 484
  2⤵
  PID:2068

memory/1748-0-0x00000000009A0000-0x00000000009C6000-memory.dmp

Filesize
152KB

Download
memory/1748-1-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/1748-2-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download