bc03b408da7dec2ece173812fb785324d98878331f23517c3ef7dcf24fa431e5 | Triage

Analysis

max time kernel
121s
max time network
156s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-10-2023 21:36

Sharing

Report Analysis Logs

General

Target

NEAS.ee15bdd19b323b09d030b44f0f939eb0.exe
Size

410KB
MD5

ee15bdd19b323b09d030b44f0f939eb0
SHA1

b6929f2d00caa487976d5044c8f409a540b30b9c
SHA256

bc03b408da7dec2ece173812fb785324d98878331f23517c3ef7dcf24fa431e5
SHA512

7d51c8b555944aabee7424549a2db669c29d89ed5c6e3f8d61e5f018a16c958c13eb54d055ffed952e802807a68868668365c7fd8e3ea88e21a7d0ace038ba34
SSDEEP

6144:mTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:mTZTYapU8N5VTVVIj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2828	2800	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2828	2800	NEAS.ee15bdd19b323b09d030b44f0f939eb0.exe	29
PID 2800 wrote to memory of 2828	2800	NEAS.ee15bdd19b323b09d030b44f0f939eb0.exe	29
PID 2800 wrote to memory of 2828	2800	NEAS.ee15bdd19b323b09d030b44f0f939eb0.exe	29
PID 2800 wrote to memory of 2828	2800	NEAS.ee15bdd19b323b09d030b44f0f939eb0.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.ee15bdd19b323b09d030b44f0f939eb0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ee15bdd19b323b09d030b44f0f939eb0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 36
  2⤵
  - Program crash
  PID:2828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2800-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download