ad4d4af8687a2e3a2657e0dcfe412c5ed9e8c293b76b78d0c6fbc44f3d196f7a

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 04:32

Target

NEAS.5c62fd12144ea243beb087511ac73c10.exe
Size

272KB
MD5

5c62fd12144ea243beb087511ac73c10
SHA1

118e22dc9fe9122135a3b2da411a9375bdc992d0
SHA256

ad4d4af8687a2e3a2657e0dcfe412c5ed9e8c293b76b78d0c6fbc44f3d196f7a
SHA512

c4b4622e9d34c7a5f0eac493cfadb0ae776b7f28820aa0a8c4c3143f8f518133148a44f48b5dcf947504210c52d1601accfc8763d33545710a4ce7e70d7af443
SSDEEP

1536:FkzXF8CvrJ4PBhDP35R1lGuw8axMMNtyCHi6JPhMBxiOQ4eb0miinYDx4:Oh8k6DP3b1lGuw8asCHNhMXi6Y0HYSx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1824	1992	WerFault.exe	24

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1824	1992	NEAS.5c62fd12144ea243beb087511ac73c10.exe	28
PID 1992 wrote to memory of 1824	1992	NEAS.5c62fd12144ea243beb087511ac73c10.exe	28
PID 1992 wrote to memory of 1824	1992	NEAS.5c62fd12144ea243beb087511ac73c10.exe	28
PID 1992 wrote to memory of 1824	1992	NEAS.5c62fd12144ea243beb087511ac73c10.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.5c62fd12144ea243beb087511ac73c10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5c62fd12144ea243beb087511ac73c10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 36
  2⤵
  - Program crash
  PID:1824

memory/1992-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download