dcc67d20f7e1afe064af19318bd1c0ef770a28872b582a40912ba286ed219b68

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 23:23

Target

NEAS.f7b5864c305f791b9127b18dded984e0.exe
Size

208KB
MD5

f7b5864c305f791b9127b18dded984e0
SHA1

bac188612436f69beaa3f5cee92e2ac859de5212
SHA256

dcc67d20f7e1afe064af19318bd1c0ef770a28872b582a40912ba286ed219b68
SHA512

c553253ccc4823acff60104caae0260b845445d964270b3c6dbb6be8717ea861b16172f07eea235b87ce0cfaf63a9b553cf53241f79c143ec368fecdc28ab593
SSDEEP

768:C6cPsAifwZJ0cZGUk6vJOBdhqm2PeaiBWJQekBPOOU02p/1H5JsXdnhfepXdnh:1ccYH/Gnc+hmlJQekB2502L2wL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	1632	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2380	1632	NEAS.f7b5864c305f791b9127b18dded984e0.exe	28
PID 1632 wrote to memory of 2380	1632	NEAS.f7b5864c305f791b9127b18dded984e0.exe	28
PID 1632 wrote to memory of 2380	1632	NEAS.f7b5864c305f791b9127b18dded984e0.exe	28
PID 1632 wrote to memory of 2380	1632	NEAS.f7b5864c305f791b9127b18dded984e0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.f7b5864c305f791b9127b18dded984e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f7b5864c305f791b9127b18dded984e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 36
  2⤵
  - Program crash
  PID:2380

memory/1632-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download