8e410354bfd4d626925a91d75b2aea1ec0e175e3d014be42694d4515d8b3e376

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
17/11/2023, 22:08

Target

NEAS.3af8ecb079c5d9362dbf72acd3d874d0.exe
Size

204KB
MD5

3af8ecb079c5d9362dbf72acd3d874d0
SHA1

9bfec74140b7b2d1a0c493bd7813edeeb931809c
SHA256

8e410354bfd4d626925a91d75b2aea1ec0e175e3d014be42694d4515d8b3e376
SHA512

6fd1899bf4b1b22e1758ae2e9d482a9dca27c6c6dd9d51db8f68711f200e558479d26885be8569f6ad0b8224ecc5dc382619ee25a3b578a8dce92815522f1163
SSDEEP

768:YDApAJmxwUh6zO5g7Wfb8BvTRbdUE6Sijv7xCIPUvjX/1H5jXdnhg:asASwKScoNSLDh8r9n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	1244	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2172	1244	NEAS.3af8ecb079c5d9362dbf72acd3d874d0.exe	28
PID 1244 wrote to memory of 2172	1244	NEAS.3af8ecb079c5d9362dbf72acd3d874d0.exe	28
PID 1244 wrote to memory of 2172	1244	NEAS.3af8ecb079c5d9362dbf72acd3d874d0.exe	28
PID 1244 wrote to memory of 2172	1244	NEAS.3af8ecb079c5d9362dbf72acd3d874d0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.3af8ecb079c5d9362dbf72acd3d874d0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3af8ecb079c5d9362dbf72acd3d874d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 36
  2⤵
  - Program crash
  PID:2172

memory/1244-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download