45bc4a3ef271eb44a5c494d8add80dac97169c3310a56177c5a24bab0950bf6d

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 04:52

Target

NEAS.5a3f73377805722508716903b97b3f90.exe
Size

208KB
MD5

5a3f73377805722508716903b97b3f90
SHA1

91a84f58de23b77dc63b3b310d6a5e3b75fbeab6
SHA256

45bc4a3ef271eb44a5c494d8add80dac97169c3310a56177c5a24bab0950bf6d
SHA512

cace9db98565934bf3ea2ae38d2099db8f6bd54b40f742baf4ee145efcdaa136927912a3a8b7040f9892f050af2be1cc9437758f59ca58a364ac23c6042d2c3a
SSDEEP

1536:fUDRi9T5sJdi9bxHNr2pnx6KaUuP6iuwJRFMOWIDiH3m:f8RinudiP52xx67lLdhpiH3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1452	1464	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1452	1464	NEAS.5a3f73377805722508716903b97b3f90.exe	14
PID 1464 wrote to memory of 1452	1464	NEAS.5a3f73377805722508716903b97b3f90.exe	14
PID 1464 wrote to memory of 1452	1464	NEAS.5a3f73377805722508716903b97b3f90.exe	14
PID 1464 wrote to memory of 1452	1464	NEAS.5a3f73377805722508716903b97b3f90.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 36
1⤵
- Program crash
PID:1452

C:\Users\Admin\AppData\Local\Temp\NEAS.5a3f73377805722508716903b97b3f90.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5a3f73377805722508716903b97b3f90.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464

memory/1464-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download