567e062fbc522b7e5de30a2445eb7078ff753b3b555a3a79ab4fd35936ed5e6b

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
18/11/2023, 02:08

Target

NEAS.5f6864f020aa7d804ea51bce7677af60.exe
Size

204KB
MD5

5f6864f020aa7d804ea51bce7677af60
SHA1

f1ebc5559a8fb0b1661d17d4babcf4242de67109
SHA256

567e062fbc522b7e5de30a2445eb7078ff753b3b555a3a79ab4fd35936ed5e6b
SHA512

4e71714b3ce7c59895f7f06a9fe4caf19d896a170872b284b17a6f67177140e054b07ed403a847974ce761a870001118b23e8c7b8ec0657e80a0fa064970a52a
SSDEEP

768:ocv+EQGtmz8coupvmxT90hdpX2mwgnZP+1H+fktVU2ZpJFo70qMqf/1H5kXdnhK:otctmnouhmxT2haJgF2ZpX4Hvlc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2436	312	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 2436	312	NEAS.5f6864f020aa7d804ea51bce7677af60.exe	28
PID 312 wrote to memory of 2436	312	NEAS.5f6864f020aa7d804ea51bce7677af60.exe	28
PID 312 wrote to memory of 2436	312	NEAS.5f6864f020aa7d804ea51bce7677af60.exe	28
PID 312 wrote to memory of 2436	312	NEAS.5f6864f020aa7d804ea51bce7677af60.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.5f6864f020aa7d804ea51bce7677af60.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5f6864f020aa7d804ea51bce7677af60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 312 -s 36
  2⤵
  - Program crash
  PID:2436

memory/312-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download