f5b19ff12b044b682ce07f8084159d999806fd4242b76d05d3fabfe15622c821 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-10-2023 21:33

Sharing

Report Analysis Logs

General

Target

NEAS.d7c3512a7e08ea769675457e0460a6e0.exe
Size

236KB
MD5

d7c3512a7e08ea769675457e0460a6e0
SHA1

4c3d96276e7257843037c406b49d5afe1ab50ba4
SHA256

f5b19ff12b044b682ce07f8084159d999806fd4242b76d05d3fabfe15622c821
SHA512

fd959b4e438e0a75cfeb4b6d5a91f1f247954a423a6bac4c46911ab0d45e48abf3be0e7a8c85964b48cd978e4b74a8f5333141d122504e9a527655e340942e2a
SSDEEP

1536:87+eltm8Y6jHO86s/6Vr65tAQjILQ9FKGXl:+llL7O86s/F5tHKG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	2648	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2452	2648	NEAS.d7c3512a7e08ea769675457e0460a6e0.exe	28
PID 2648 wrote to memory of 2452	2648	NEAS.d7c3512a7e08ea769675457e0460a6e0.exe	28
PID 2648 wrote to memory of 2452	2648	NEAS.d7c3512a7e08ea769675457e0460a6e0.exe	28
PID 2648 wrote to memory of 2452	2648	NEAS.d7c3512a7e08ea769675457e0460a6e0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.d7c3512a7e08ea769675457e0460a6e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d7c3512a7e08ea769675457e0460a6e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 36
  2⤵
  - Program crash
  PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2648-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download