8ed620267f1d4737fb1620befc7e045b7bf673e31ce2efbb11a09d2876c92098

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
18-11-2023 04:48

Target

NEAS.010c9468dc802d3f8a9589aa048182e0.exe
Size

732KB
MD5

010c9468dc802d3f8a9589aa048182e0
SHA1

ac8295f1ac0529bd55a904e9e65bd85fb02f4742
SHA256

8ed620267f1d4737fb1620befc7e045b7bf673e31ce2efbb11a09d2876c92098
SHA512

9b594310d420ab393ada94d5acebd9253234abb2d7af496e3a4fe29e43f696c72eac9e10e27e07b987715d2fd31c41ef708208bf82c9e14555dc1c592efcc581
SSDEEP

1536:QUDRi9T5sJdi9bxHNr2pnx6KaUuP6iuwJRcOWEkiH:Q8RinudiP52xx67lLdKiH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	2136	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2124	2136	NEAS.010c9468dc802d3f8a9589aa048182e0.exe	28
PID 2136 wrote to memory of 2124	2136	NEAS.010c9468dc802d3f8a9589aa048182e0.exe	28
PID 2136 wrote to memory of 2124	2136	NEAS.010c9468dc802d3f8a9589aa048182e0.exe	28
PID 2136 wrote to memory of 2124	2136	NEAS.010c9468dc802d3f8a9589aa048182e0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.010c9468dc802d3f8a9589aa048182e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.010c9468dc802d3f8a9589aa048182e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 36
  2⤵
  - Program crash
  PID:2124

memory/2136-1-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download