7feab913847ffd9be298f5a6c0dcb147ac810fdc20f05189a3a65509d2328c74

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 10:39

Target

44d04532eb10e6c7b84d880445f732d0_NEAS.exe
Size

7KB
MD5

44d04532eb10e6c7b84d880445f732d0
SHA1

e02d677286536f395b18fa72feb33d79f33badbc
SHA256

7feab913847ffd9be298f5a6c0dcb147ac810fdc20f05189a3a65509d2328c74
SHA512

8268d1ef71db63f8e4d5a20fdba84cba698e020fbd537b61828bf85d2b890ca727d66ba698aeca6c5d66f85bfb06af6acdb7bb4d24c8393e3d1031fc4837dcf0
SSDEEP

192:vOshySXiLcIsLI1NceUFLkLCwGEBVZgYq51T:5XiLyLKNceUFLkL3fBVxq51

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2136	2980	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	44d04532eb10e6c7b84d880445f732d0_NEAS.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2136	2980	44d04532eb10e6c7b84d880445f732d0_NEAS.exe	28
PID 2980 wrote to memory of 2136	2980	44d04532eb10e6c7b84d880445f732d0_NEAS.exe	28
PID 2980 wrote to memory of 2136	2980	44d04532eb10e6c7b84d880445f732d0_NEAS.exe	28
PID 2980 wrote to memory of 2136	2980	44d04532eb10e6c7b84d880445f732d0_NEAS.exe	28

C:\Users\Admin\AppData\Local\Temp\44d04532eb10e6c7b84d880445f732d0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\44d04532eb10e6c7b84d880445f732d0_NEAS.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 1008
  2⤵
  - Program crash
  PID:2136

memory/2980-2-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2980-1-0x00000000010D0000-0x00000000010D8000-memory.dmp

Filesize
32KB

Download
memory/2980-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/2980-3-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/2980-4-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download