12ec49b6da4a4f7f258c672e1a702ef9c6553ed23ee3f026c7b8529920e44e29

Analysis

max time kernel
163s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2023, 04:45

Target

NEAS.18120d1d080f6f1c110662908576a930.exe
Size

260KB
MD5

18120d1d080f6f1c110662908576a930
SHA1

8d46f835c56bae93e227aa41ec25f8dd8aaf2c8b
SHA256

12ec49b6da4a4f7f258c672e1a702ef9c6553ed23ee3f026c7b8529920e44e29
SHA512

e515cb03def45a530984d9e333fa26c80727d626b1bf1fa6a0cec6f7b061c9547622caa7b739db5de629dcbda8dbefe1a303f2d826cd74aaff97e4b44b4df002
SSDEEP

768:rghK7eTFP2i9sxRxdInJGdfFG7pIFk924pymRFJGFI7ar4EUwVUGT1jWVvfQ:F7zi96HKGzQIFk92zmRVl6ZTCfQ

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3752	1832	WerFault.exe	18
648	1832	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 3752	1832	NEAS.18120d1d080f6f1c110662908576a930.exe	93
PID 1832 wrote to memory of 3752	1832	NEAS.18120d1d080f6f1c110662908576a930.exe	93
PID 1832 wrote to memory of 3752	1832	NEAS.18120d1d080f6f1c110662908576a930.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.18120d1d080f6f1c110662908576a930.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.18120d1d080f6f1c110662908576a930.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 144
  2⤵
  - Program crash
  PID:3752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 144
  2⤵
  - Program crash
  PID:648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1832 -ip 1832
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1832 -ip 1832
1⤵
PID:3716

memory/1832-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download