6b036199b45d0ec8e5edefc9fd844f944eaac4a268be61a0e8600966c45e6728

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
17/11/2023, 22:08

Target

NEAS.7371bb2c9352a4bc97001730d45fa360.exe
Size

208KB
MD5

7371bb2c9352a4bc97001730d45fa360
SHA1

77604465860777017b59060e1e94838649bfbf43
SHA256

6b036199b45d0ec8e5edefc9fd844f944eaac4a268be61a0e8600966c45e6728
SHA512

f941d209ddc9ab58cdef33446063633cf2c7006a8baa633249f128afe4f68bf8b8dc0071f5ddfa1da5a2cd4b6127947f536f9e664aa29ff422793ab505b7747c
SSDEEP

1536:S3apwXo6snSI7+4TfjBskSx8x35ncc+rpPJrpHOkxsOUR1YR:MC6xRyfFP0o35cc+rpQOUzY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1192	2584	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 1192	2584	NEAS.7371bb2c9352a4bc97001730d45fa360.exe	28
PID 2584 wrote to memory of 1192	2584	NEAS.7371bb2c9352a4bc97001730d45fa360.exe	28
PID 2584 wrote to memory of 1192	2584	NEAS.7371bb2c9352a4bc97001730d45fa360.exe	28
PID 2584 wrote to memory of 1192	2584	NEAS.7371bb2c9352a4bc97001730d45fa360.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.7371bb2c9352a4bc97001730d45fa360.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7371bb2c9352a4bc97001730d45fa360.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 36
  2⤵
  - Program crash
  PID:1192

memory/2584-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download