698f4d4ea8b498979a115c79970b92494f0b0451b8c980b1381be28d972343f0

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13-11-2023 02:56

Target

NEAS.5c2810848c6e17f4375d6831190754f0.exe
Size

204KB
MD5

5c2810848c6e17f4375d6831190754f0
SHA1

e14cb772c4c1594b35a5b0ec911c85d0ff07209c
SHA256

698f4d4ea8b498979a115c79970b92494f0b0451b8c980b1381be28d972343f0
SHA512

940ec4871d8b6b937c62651a68f54ed33bc15a32e132f263d7f3975fb6c238f8d3747ee96c2933fd750f9dac361b2d090c4ea5659bcacdfb314ec5bb6dc9b472
SSDEEP

3072:BlQdL3eS0Fsz1ENTA4Ub1ZVzrKrg8Y951Sm8hSaYwWP5Cer2cN2j+mjES2XSPyct:S3e9qbtrKct9TjViPcNmii2s

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	1724	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2928	1724	NEAS.5c2810848c6e17f4375d6831190754f0.exe	28
PID 1724 wrote to memory of 2928	1724	NEAS.5c2810848c6e17f4375d6831190754f0.exe	28
PID 1724 wrote to memory of 2928	1724	NEAS.5c2810848c6e17f4375d6831190754f0.exe	28
PID 1724 wrote to memory of 2928	1724	NEAS.5c2810848c6e17f4375d6831190754f0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.5c2810848c6e17f4375d6831190754f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5c2810848c6e17f4375d6831190754f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 36
  2⤵
  - Program crash
  PID:2928