250cf3294acf8e978da142f4d81de38eba03735e82041124e8871157fbc69a23

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 09:30

Target

NEAS.b83d36b41320c2960b4516942a332d20.exe
Size

188KB
MD5

b83d36b41320c2960b4516942a332d20
SHA1

1d7c0ef97b79aa5d98256ed0c4ac8901ef7a447c
SHA256

250cf3294acf8e978da142f4d81de38eba03735e82041124e8871157fbc69a23
SHA512

2fab99a74d4523f2189822b17d8668edbdc15637b9b7824a7b1e5d4fe5a8397713f21d8ff623d67b3fb8c3984341c446172403ed3be9e3238e4358687360b242
SSDEEP

768:aEA+elap4nNM8+R6N5HzHa86fsWC/QVrMg18L/1H5k:a7+eltm8Y6jHO86s/QVje9O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	1980	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2192	1980	NEAS.b83d36b41320c2960b4516942a332d20.exe	28
PID 1980 wrote to memory of 2192	1980	NEAS.b83d36b41320c2960b4516942a332d20.exe	28
PID 1980 wrote to memory of 2192	1980	NEAS.b83d36b41320c2960b4516942a332d20.exe	28
PID 1980 wrote to memory of 2192	1980	NEAS.b83d36b41320c2960b4516942a332d20.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.b83d36b41320c2960b4516942a332d20.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b83d36b41320c2960b4516942a332d20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 36
  2⤵
  - Program crash
  PID:2192

memory/1980-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download