619a590c46d04816e983a3caeab59c861cebec8e65133464477c4e642a8ea63a

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
17/11/2023, 01:30

Target

NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe
Size

264KB
MD5

e77d68a2e8e77cc1b8cf5f9f9227f320
SHA1

38ea3a86779a5451b505acc8c9499b083e5ebe6b
SHA256

619a590c46d04816e983a3caeab59c861cebec8e65133464477c4e642a8ea63a
SHA512

615e4909cce725f1d8e23e4b5c9dca2629ca176e05a663070b049007d2b940a996d96173a14aa0f7a3156b17ca5143430267c29a606efe675d46521b4757e86b
SSDEEP

1536:PvzXF8CvrJ4PBhDP35RJdeqVQdgy2df7kcaEBaWMKAmpw9mo7:3h8k6DP3bDeqV4gyufh4gAmpw9mo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	2132	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2364	2132	NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe	28
PID 2132 wrote to memory of 2364	2132	NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe	28
PID 2132 wrote to memory of 2364	2132	NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe	28
PID 2132 wrote to memory of 2364	2132	NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e77d68a2e8e77cc1b8cf5f9f9227f320.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 36
  2⤵
  - Program crash
  PID:2364

memory/2132-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download