555f7667c47cbb6a730feebc13489ca16d7c386c45105aa8f7869b3e25289941

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
17/11/2023, 02:30

Target

NEAS.2b284222fe3c25324c35e9d7be12a910.exe
Size

204KB
MD5

2b284222fe3c25324c35e9d7be12a910
SHA1

d048e332702121146a23edad3578d7e2534da87d
SHA256

555f7667c47cbb6a730feebc13489ca16d7c386c45105aa8f7869b3e25289941
SHA512

6b9af8848bd7ec6b80ebf429806ce63b951d6cfde0e904e0762b5d42b4d7fa52124e180ef57fbc3ca033e432810b4e553b64d82420ebac0d5b78644fa288b78b
SSDEEP

1536:H3apwXo6snSI7+4TfjBskSx8x35ncc+rpPJrpHtkxkOURQ0:XC6xRyfFP0o35cc+rpXOUu0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2740	2700	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2740	2700	NEAS.2b284222fe3c25324c35e9d7be12a910.exe	29
PID 2700 wrote to memory of 2740	2700	NEAS.2b284222fe3c25324c35e9d7be12a910.exe	29
PID 2700 wrote to memory of 2740	2700	NEAS.2b284222fe3c25324c35e9d7be12a910.exe	29
PID 2700 wrote to memory of 2740	2700	NEAS.2b284222fe3c25324c35e9d7be12a910.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.2b284222fe3c25324c35e9d7be12a910.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2b284222fe3c25324c35e9d7be12a910.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 36
  2⤵
  - Program crash
  PID:2740

memory/2700-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download