af4515e02124efa2f841c419aa392dab160c32b82a56c549ace6efe9abd11bd6

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 00:26

Target

NEAS.c765945b59e940ecf59497c73ed88500.exe
Size

264KB
MD5

c765945b59e940ecf59497c73ed88500
SHA1

4505eef2d78d89f828223ec6eae0ab01f6b3cc37
SHA256

af4515e02124efa2f841c419aa392dab160c32b82a56c549ace6efe9abd11bd6
SHA512

5d383aabd08521310c3238de08211f4a9db36c9365008c3b760f5f69e1a9509cadfbebbdfb783c34bd8275d704ddbc45caf854bdc56b311b96a58c2de10ae3f8
SSDEEP

1536:PvzXF8CvrJ4PBhDP35Rn6q1Qdgy2df7kcaEBaWMKAmpw9mo7:3h8k6DP3bn6q14gyufh4gAmpw9mo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2168	2364	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2168	2364	NEAS.c765945b59e940ecf59497c73ed88500.exe	28
PID 2364 wrote to memory of 2168	2364	NEAS.c765945b59e940ecf59497c73ed88500.exe	28
PID 2364 wrote to memory of 2168	2364	NEAS.c765945b59e940ecf59497c73ed88500.exe	28
PID 2364 wrote to memory of 2168	2364	NEAS.c765945b59e940ecf59497c73ed88500.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.c765945b59e940ecf59497c73ed88500.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c765945b59e940ecf59497c73ed88500.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 36
  2⤵
  - Program crash
  PID:2168

memory/2364-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download