dc7e3e35db22cd036343051aa87f4a5a24821b66d8406d11282001a894324ef1

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
18/11/2023, 05:23

Target

NEAS.0fcd785360517eca01ec7b1b5e83aea0.exe
Size

260KB
MD5

0fcd785360517eca01ec7b1b5e83aea0
SHA1

40b1f4f98db438a2be5e2d31cd5a17a858a4b5db
SHA256

dc7e3e35db22cd036343051aa87f4a5a24821b66d8406d11282001a894324ef1
SHA512

5dd08bf72bf1981bad525a64db67c61847ba7fe31063e8acb034fe9c1bbf67ef39cb8af47c966de989f772647bb5f1cefb31fe5e8bed345694d96e5ffc1fd431
SSDEEP

1536:2D2PEJZYss1/mVHNDeQWjxiMFOXiV4rN+zL20gJi1i:vPEJZJs1/+9eQuPFOXiVUgzL20WK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2120	1144	WerFault.exe	6

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 2120	1144	NEAS.0fcd785360517eca01ec7b1b5e83aea0.exe	28
PID 1144 wrote to memory of 2120	1144	NEAS.0fcd785360517eca01ec7b1b5e83aea0.exe	28
PID 1144 wrote to memory of 2120	1144	NEAS.0fcd785360517eca01ec7b1b5e83aea0.exe	28
PID 1144 wrote to memory of 2120	1144	NEAS.0fcd785360517eca01ec7b1b5e83aea0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.0fcd785360517eca01ec7b1b5e83aea0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0fcd785360517eca01ec7b1b5e83aea0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 36
  2⤵
  - Program crash
  PID:2120

memory/1144-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download