21e7bc953848b80d1ebc6df2a75b23440a9034f4e115921d9e94315effbf551c | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 19:14

Sharing

Report Analysis Logs

General

Target

NEAS.cd055177e4a50c076ed298a53a5f3270.exe
Size

256KB
MD5

cd055177e4a50c076ed298a53a5f3270
SHA1

b23b1e0be83b9e11933fa8c4b5528088a3aa80ae
SHA256

21e7bc953848b80d1ebc6df2a75b23440a9034f4e115921d9e94315effbf551c
SHA512

a4b8a6c4a9d32e59a741c74ee33df46ee41837ea44c2d5c97c735c776c3ec5850a0ec0852f11adf3661afab527b4cff7fe18aaf5e081b2cece8046c51bb5b0c0
SSDEEP

3072:kC6xRyfFP0o35cc+rpbO8upSJdEN0s4WE+3:kC6xRydsS+lUYENm+3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	2988	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3060	2988	NEAS.cd055177e4a50c076ed298a53a5f3270.exe	28
PID 2988 wrote to memory of 3060	2988	NEAS.cd055177e4a50c076ed298a53a5f3270.exe	28
PID 2988 wrote to memory of 3060	2988	NEAS.cd055177e4a50c076ed298a53a5f3270.exe	28
PID 2988 wrote to memory of 3060	2988	NEAS.cd055177e4a50c076ed298a53a5f3270.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.cd055177e4a50c076ed298a53a5f3270.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cd055177e4a50c076ed298a53a5f3270.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 36
  2⤵
  - Program crash
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download