210c234f0aa9eb24e3ae39948ae069e41c84a55c1b7117e6489123ad62f656f2 | Triage

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.20eb72fd21aeb585531377b97caeacb0_JC.exe
Size

1.5MB
MD5

20eb72fd21aeb585531377b97caeacb0
SHA1

e6834dd1f8867df5e28b6ffe7fd493faa1a0c12d
SHA256

210c234f0aa9eb24e3ae39948ae069e41c84a55c1b7117e6489123ad62f656f2
SHA512

f22b663d3b0994a26ab82ba5915e0f05cb9ebe4a7643a4f8a03d5853fcdb9ba7348ff15137617c6f7da46c0d190372ce7d01adefd700b48cee97f8161053f369
SSDEEP

49152:r0ibuGD1U0YRIbehmMA4xp4O8b8ITDnljS:rIRe9S

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	2592	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 836	2592	NEAS.20eb72fd21aeb585531377b97caeacb0_JC.exe	28
PID 2592 wrote to memory of 836	2592	NEAS.20eb72fd21aeb585531377b97caeacb0_JC.exe	28
PID 2592 wrote to memory of 836	2592	NEAS.20eb72fd21aeb585531377b97caeacb0_JC.exe	28
PID 2592 wrote to memory of 836	2592	NEAS.20eb72fd21aeb585531377b97caeacb0_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.20eb72fd21aeb585531377b97caeacb0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.20eb72fd21aeb585531377b97caeacb0_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 152
  2⤵
  - Program crash
  PID:836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2592-0-0x0000000000A40000-0x0000000000BCD000-memory.dmp

Filesize
1.6MB

Download
memory/2592-1-0x0000000000A40000-0x0000000000BCD000-memory.dmp

Filesize
1.6MB

Download