0120dc5f79475316f5caffeffa770c7104031e15e09de257933eff9dfb1ae275

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 00:45

Target

NEAS.a77b802f945c514c40702146b44033f0.exe
Size

320KB
MD5

a77b802f945c514c40702146b44033f0
SHA1

61b6e1be425ab65c31c107c40cad3d52934a3046
SHA256

0120dc5f79475316f5caffeffa770c7104031e15e09de257933eff9dfb1ae275
SHA512

d52ddb246c9cabf593f23d6d2deac46dbb1468263817b2600153abda298444cdec83df0c5e114a5a5945b759e890d902182e9d2f0e6bc15fd5b42b4cdb27cebf
SSDEEP

6144:c+Ed/U20H2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:cxqN2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1568	2948	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 1568	2948	NEAS.a77b802f945c514c40702146b44033f0.exe	28
PID 2948 wrote to memory of 1568	2948	NEAS.a77b802f945c514c40702146b44033f0.exe	28
PID 2948 wrote to memory of 1568	2948	NEAS.a77b802f945c514c40702146b44033f0.exe	28
PID 2948 wrote to memory of 1568	2948	NEAS.a77b802f945c514c40702146b44033f0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.a77b802f945c514c40702146b44033f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.a77b802f945c514c40702146b44033f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 36
  2⤵
  - Program crash
  PID:1568

memory/2948-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download