ecbf19defbe34778b0ff70bc164310dbb3cda6889d90f9613fc98e5bce074445

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 03:22

Target

NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe
Size

143KB
MD5

ebaea2d058f6922268dbe0fdabe6e6e0
SHA1

ce2a24338fa2303f636c9e097e6635320c0f10a0
SHA256

ecbf19defbe34778b0ff70bc164310dbb3cda6889d90f9613fc98e5bce074445
SHA512

f29b2e994ec0a2242e30bf79e302697b805a211f732d2786ed95e7566c9443140901698773880fb503471f5351913c562ecd3a114d5e0628a2cd1d5a9193f063
SSDEEP

3072:o+HcL2mCfiTntqSQRruiMZMqqDL2/AwvdL7Vjp9:hIDtORruiMyqqDL6tvdxp9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2028	2040	NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe	28
PID 2040 wrote to memory of 2028	2040	NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe	28
PID 2040 wrote to memory of 2028	2040	NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe	28
PID 2040 wrote to memory of 2028	2040	NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ebaea2d058f6922268dbe0fdabe6e6e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 88
  2⤵
  - Program crash
  PID:2028