f66cead1c849badc5f9a8a74a56ffcd5d0d9a16fc4bcc7288fadb92dfc50c1e5

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 23:28

Target

NEAS.ae0cfaa0cc9df4bf81c91b73991b08a0.exe
Size

232KB
MD5

ae0cfaa0cc9df4bf81c91b73991b08a0
SHA1

824c577edb06f4c84d4ea2c866a1b7f45133e6e9
SHA256

f66cead1c849badc5f9a8a74a56ffcd5d0d9a16fc4bcc7288fadb92dfc50c1e5
SHA512

26684465f8b7e839d572e0ced38be3c3b925906fd089ab11644972a0463a105b7e6f6b34de43d3127a923519a6289a27c617ce00afc19c672c2a743d73b12b52
SSDEEP

768:J6cPsAifwZJ0cZGUk6vJOBdhqm2PeaiBWJQekhgjUR2p/1H5wrXdnhYakM8M:YccYH/Gnc+hmlJQek2wR2LuAMt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	1264	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1352	1264	NEAS.ae0cfaa0cc9df4bf81c91b73991b08a0.exe	28
PID 1264 wrote to memory of 1352	1264	NEAS.ae0cfaa0cc9df4bf81c91b73991b08a0.exe	28
PID 1264 wrote to memory of 1352	1264	NEAS.ae0cfaa0cc9df4bf81c91b73991b08a0.exe	28
PID 1264 wrote to memory of 1352	1264	NEAS.ae0cfaa0cc9df4bf81c91b73991b08a0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.ae0cfaa0cc9df4bf81c91b73991b08a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ae0cfaa0cc9df4bf81c91b73991b08a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 36
  2⤵
  - Program crash
  PID:1352

memory/1264-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download