2166dac31ab9f8bb5e7fa37dfb789a6165cbdd2964febeae9d339f0e2bab6a7a

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 00:20

Target

NEAS.731742c75c3d823098c451516a3ad230.exe
Size

472KB
MD5

731742c75c3d823098c451516a3ad230
SHA1

709a67aafda35f85447e8bbbc0fb35d765074e70
SHA256

2166dac31ab9f8bb5e7fa37dfb789a6165cbdd2964febeae9d339f0e2bab6a7a
SHA512

0b10454428a082169e68384002e02c1e3ae25824faf50c77bc1ef474fcb487453c9700eb350a6b9796011d9f4493aa0d01ecfb085de9b20cc4827064b55e00b1
SSDEEP

3072:+8RinudiP52xx67lLd3iHDo9Jyd0Wxn4dIK4hR4WYoyl:TkgiPA6RZPKn4SX4V

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	1736	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1760	1736	NEAS.731742c75c3d823098c451516a3ad230.exe	28
PID 1736 wrote to memory of 1760	1736	NEAS.731742c75c3d823098c451516a3ad230.exe	28
PID 1736 wrote to memory of 1760	1736	NEAS.731742c75c3d823098c451516a3ad230.exe	28
PID 1736 wrote to memory of 1760	1736	NEAS.731742c75c3d823098c451516a3ad230.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.731742c75c3d823098c451516a3ad230.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.731742c75c3d823098c451516a3ad230.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 36
  2⤵
  - Program crash
  PID:1760

memory/1736-1-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download