2f8391f67f22b3e29c7e8103f8f3ebd1daa37077b1bbe304c0ca0e888250fd25

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 07:37

Target

NEAS.cbeb2e7030b3135c4a3ea5db1ef4e760.exe
Size

208KB
MD5

cbeb2e7030b3135c4a3ea5db1ef4e760
SHA1

99718e0c421017a970c91f5df368ffabd01695db
SHA256

2f8391f67f22b3e29c7e8103f8f3ebd1daa37077b1bbe304c0ca0e888250fd25
SHA512

97472fd773779fa21db94dd4b432cb9adc0786f36a44f814c4d3f2d865ba0e7d3f5383262a4ad2cb4d9cfd19e7a3b592715172242534647f8972427df3a92273
SSDEEP

1536:FUDRi9T5sJdi9bxHNr2pnx6KaUuP6iuwJRFgOW8PiH3:F8RinudiP52xx67lLdh5iH3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	2696	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2212	2696	NEAS.cbeb2e7030b3135c4a3ea5db1ef4e760.exe	28
PID 2696 wrote to memory of 2212	2696	NEAS.cbeb2e7030b3135c4a3ea5db1ef4e760.exe	28
PID 2696 wrote to memory of 2212	2696	NEAS.cbeb2e7030b3135c4a3ea5db1ef4e760.exe	28
PID 2696 wrote to memory of 2212	2696	NEAS.cbeb2e7030b3135c4a3ea5db1ef4e760.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.cbeb2e7030b3135c4a3ea5db1ef4e760.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cbeb2e7030b3135c4a3ea5db1ef4e760.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 36
  2⤵
  - Program crash
  PID:2212

memory/2696-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download