6f8a4f5bc0730ce60ac5a19050d92f8eabf260e8790508e554e57c2bb1ba2bd1

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 03:10

Target

NEAS.11b69f9afcea637c7dc0e9b2f23d01b0.exe
Size

240KB
MD5

11b69f9afcea637c7dc0e9b2f23d01b0
SHA1

a034d3e257eb323a775b7c739c7f5ea3b326062a
SHA256

6f8a4f5bc0730ce60ac5a19050d92f8eabf260e8790508e554e57c2bb1ba2bd1
SHA512

c2e20c16dc69bf0d3113dd091430d336df9570264d0f342996519df99f72ee1d30e2a4185e5832ccd2e761c82ea8b0e43c3b7daa3bd3ba199c9a06faca24b8dc
SSDEEP

768:Ag6cPsAifwZJ0cZGUk6vJOBdhqm2PeaiBWJQek+lrU4H2p/1H5CgXdnhkEBZF5Ep:0ccYH/Gnc+hmlJQekMI4H2LfaWFNRgj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2060	1976	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2060	1976	NEAS.11b69f9afcea637c7dc0e9b2f23d01b0.exe	28
PID 1976 wrote to memory of 2060	1976	NEAS.11b69f9afcea637c7dc0e9b2f23d01b0.exe	28
PID 1976 wrote to memory of 2060	1976	NEAS.11b69f9afcea637c7dc0e9b2f23d01b0.exe	28
PID 1976 wrote to memory of 2060	1976	NEAS.11b69f9afcea637c7dc0e9b2f23d01b0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.11b69f9afcea637c7dc0e9b2f23d01b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.11b69f9afcea637c7dc0e9b2f23d01b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 36
  2⤵
  - Program crash
  PID:2060

memory/1976-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download