d0305b3fadfc5687722e2888bd2b810d55fa8505d6a12eeed9bd89cc92f3dc11

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 05:00

Target

NEAS.9e3be931016dc2886670f7f4da504d40.exe
Size

260KB
MD5

9e3be931016dc2886670f7f4da504d40
SHA1

4b7da668f511d043cc171f1a23fef9e50226beef
SHA256

d0305b3fadfc5687722e2888bd2b810d55fa8505d6a12eeed9bd89cc92f3dc11
SHA512

e67391173774ca7bb04d358a1eacda2e8e081bd3687f0d15eb5d47b97e838cf26b4da38a31fc87a25ccea022b80e8216c90e8870a3489abd305dd3d9def9d408
SSDEEP

768:U7DApAJmxwUh6zO5g7Wfb8BvTRbdUE6Sijv7xCIp207js/1H54XdnhgdwQU3bIEW:ksASwKScoNSLDhpVnu0ZrI1jHJZrR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	2580	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2760	2580	NEAS.9e3be931016dc2886670f7f4da504d40.exe	28
PID 2580 wrote to memory of 2760	2580	NEAS.9e3be931016dc2886670f7f4da504d40.exe	28
PID 2580 wrote to memory of 2760	2580	NEAS.9e3be931016dc2886670f7f4da504d40.exe	28
PID 2580 wrote to memory of 2760	2580	NEAS.9e3be931016dc2886670f7f4da504d40.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.9e3be931016dc2886670f7f4da504d40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9e3be931016dc2886670f7f4da504d40.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 36
  2⤵
  - Program crash
  PID:2760

memory/2580-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download