6333b2e2ae232c64cbf81ea22cd132350bcfb8aa34f4650ee7748fdd499d9f19

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 21:52

Target

NEAS.b0b41a2c42887bf91abc1fd698a7e6a0.exe
Size

204KB
MD5

b0b41a2c42887bf91abc1fd698a7e6a0
SHA1

507d04c00ba3c57abeaf121ba17602929e72dbfa
SHA256

6333b2e2ae232c64cbf81ea22cd132350bcfb8aa34f4650ee7748fdd499d9f19
SHA512

9bac9ac35adb891e56e4a598ce45d7fcee2f26a629affee8df3cb5861995d91f5f91ae015a825c04d36a8b76ef2832b9ec80d705f9ff8ea440191d7b50affaa2
SSDEEP

768:+6cPsAifwZJ0cZGUk6vJOBdhqm2PeaiBWJQek6dRU02p/1H5NXdnh:5ccYH/Gnc+hmlJQekA602LB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	1408	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2864	1408	NEAS.b0b41a2c42887bf91abc1fd698a7e6a0.exe	28
PID 1408 wrote to memory of 2864	1408	NEAS.b0b41a2c42887bf91abc1fd698a7e6a0.exe	28
PID 1408 wrote to memory of 2864	1408	NEAS.b0b41a2c42887bf91abc1fd698a7e6a0.exe	28
PID 1408 wrote to memory of 2864	1408	NEAS.b0b41a2c42887bf91abc1fd698a7e6a0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.b0b41a2c42887bf91abc1fd698a7e6a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b0b41a2c42887bf91abc1fd698a7e6a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 36
  2⤵
  - Program crash
  PID:2864

memory/1408-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download