0aa0cfdfa3133802b45009c42ae0b4ebe6766c4341271ac4a5fe676d9df617db

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
17/11/2023, 03:42

Target

NEAS.133e2d849eae3f4ddeaa6f0becff66b0.exe
Size

112KB
MD5

133e2d849eae3f4ddeaa6f0becff66b0
SHA1

e18425428fb602659ccc3c8e4ee55877c3535088
SHA256

0aa0cfdfa3133802b45009c42ae0b4ebe6766c4341271ac4a5fe676d9df617db
SHA512

08f1f73c26a837dacd84addbe366dd49b6fbbdb7a2fbe6412c081c409b53f8c8c406f61ee9cbc574d490f000db6aaac00c714a38d4881ed29f7f8a1b365de2cb
SSDEEP

768:15X3nnYG7MlSdn/jpSKOojKD7H5ZczpbOuf19jbEpDWIajDsXPhGPhGPhGPhtU:7P7M8d/rOzPzypyCHjKDjfQQQtU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	2488	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1916	2488	NEAS.133e2d849eae3f4ddeaa6f0becff66b0.exe	27
PID 2488 wrote to memory of 1916	2488	NEAS.133e2d849eae3f4ddeaa6f0becff66b0.exe	27
PID 2488 wrote to memory of 1916	2488	NEAS.133e2d849eae3f4ddeaa6f0becff66b0.exe	27
PID 2488 wrote to memory of 1916	2488	NEAS.133e2d849eae3f4ddeaa6f0becff66b0.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.133e2d849eae3f4ddeaa6f0becff66b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.133e2d849eae3f4ddeaa6f0becff66b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 36
  2⤵
  - Program crash
  PID:1916

memory/2488-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download