40ecb6713dcc63b382518cd42976d141ed16ad3dfd12d1a938ae055670312489

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
17/11/2023, 04:25

Target

NEAS.94d588e4da06fd786761103bef9fbe90.exe
Size

208KB
MD5

94d588e4da06fd786761103bef9fbe90
SHA1

90a6ba25216d4ed468030a4b2f43cbdb28f4b7f0
SHA256

40ecb6713dcc63b382518cd42976d141ed16ad3dfd12d1a938ae055670312489
SHA512

700fe890e5d3ce97683be984bac94b324c616a2d8e6c224c2107266d666aa80310c649a5286fc58a477b6396883caad2d7187179d1a36b97e9218e0290064c09
SSDEEP

1536:fUDRi9T5sJdi9bxHNr2pnx6KaUuP6iuwJRF/OWUbiH3F:f8RinudiP52xx67lLdhoiH3F

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2444	1816	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2444	1816	NEAS.94d588e4da06fd786761103bef9fbe90.exe	28
PID 1816 wrote to memory of 2444	1816	NEAS.94d588e4da06fd786761103bef9fbe90.exe	28
PID 1816 wrote to memory of 2444	1816	NEAS.94d588e4da06fd786761103bef9fbe90.exe	28
PID 1816 wrote to memory of 2444	1816	NEAS.94d588e4da06fd786761103bef9fbe90.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.94d588e4da06fd786761103bef9fbe90.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.94d588e4da06fd786761103bef9fbe90.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 36
  2⤵
  - Program crash
  PID:2444

memory/1816-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download