dc58579a8300c18e346ed4d9428acc1b344848fe0e74be8f3c53d1436dec7a1f

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
18/11/2023, 07:11

Target

NEAS.01de67b501d94d068443e13787e1c310.exe
Size

188KB
MD5

01de67b501d94d068443e13787e1c310
SHA1

939757d495c70fc3e4eec646a2f6efd1f3fa1fb1
SHA256

dc58579a8300c18e346ed4d9428acc1b344848fe0e74be8f3c53d1436dec7a1f
SHA512

4a4841dac9aa97819b69d199c69209a2370932f1c83a4be9d2f51ca2ea94351b8aebee371f217ec83ca60466a986abd82dd73a6308b4652d74b7d1ddad4aef82
SSDEEP

768:aEA+elap4nNM8+R6N5HzHa86fsWC/wVrM068L/1H5:a7+eltm8Y6jHO86s/wVr99

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	2196	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2208	2196	NEAS.01de67b501d94d068443e13787e1c310.exe	28
PID 2196 wrote to memory of 2208	2196	NEAS.01de67b501d94d068443e13787e1c310.exe	28
PID 2196 wrote to memory of 2208	2196	NEAS.01de67b501d94d068443e13787e1c310.exe	28
PID 2196 wrote to memory of 2208	2196	NEAS.01de67b501d94d068443e13787e1c310.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.01de67b501d94d068443e13787e1c310.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.01de67b501d94d068443e13787e1c310.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 36
  2⤵
  - Program crash
  PID:2208

memory/2196-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download