e777a76742b6808cc27628765ae3f98b10dee74fd098c5d062da77e51598aa55

Analysis

max time kernel
193s
max time network
165s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0e92f460c297f8439e07515299107fe0.exe
Size

393KB
MD5

0e92f460c297f8439e07515299107fe0
SHA1

c6b371b7db1778cbd7fe60def300d2dc88ffbdbc
SHA256

e777a76742b6808cc27628765ae3f98b10dee74fd098c5d062da77e51598aa55
SHA512

9c78fc95dfdd0c3cc40490966680a7c7804a22186120c0faeaba1002d3701864c7762a5314db9b1c0c34fcd0e5c544720fd24bfd24c1ef58184e9876e65d817c
SSDEEP

6144:WbFOegEtFfiKrhkYeMDkCluIxywtvWDcalTbIigvH6Dpp:Wb0aFikFNvuEywtvWn/ILvaDpp

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
3048	WerFault.exe
3048	WerFault.exe
3048	WerFault.exe
3048	WerFault.exe
3048	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	2724	WerFault.exe	21

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2724	NEAS.0e92f460c297f8439e07515299107fe0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3048	2724	NEAS.0e92f460c297f8439e07515299107fe0.exe	29
PID 2724 wrote to memory of 3048	2724	NEAS.0e92f460c297f8439e07515299107fe0.exe	29
PID 2724 wrote to memory of 3048	2724	NEAS.0e92f460c297f8439e07515299107fe0.exe	29
PID 2724 wrote to memory of 3048	2724	NEAS.0e92f460c297f8439e07515299107fe0.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.0e92f460c297f8439e07515299107fe0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0e92f460c297f8439e07515299107fe0.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 264
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\NEAS.0e92f460c297f8439e07515299107fe0.exe

Filesize
399KB

MD5
c7197cde8d8194ac2b1fdba700f0cac8

SHA1
4c5de9983998f3104f0c1cbb76768771b87620ad

SHA256
35869aacc2804ab41760f353563b9bdff822649bb728c7dcf65c5c2d578cc9a1

SHA512
f14e12de790d75aaf7ccadafd2e3785946eec6b2209e52d2815863a3bc3705cf02ab66da9eaad0737762b95ad37b770aaf71cd3a3b28a3430d00930e865b961d

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.0e92f460c297f8439e07515299107fe0.exe

Filesize
399KB

MD5
c7197cde8d8194ac2b1fdba700f0cac8

SHA1
4c5de9983998f3104f0c1cbb76768771b87620ad

SHA256
35869aacc2804ab41760f353563b9bdff822649bb728c7dcf65c5c2d578cc9a1

SHA512
f14e12de790d75aaf7ccadafd2e3785946eec6b2209e52d2815863a3bc3705cf02ab66da9eaad0737762b95ad37b770aaf71cd3a3b28a3430d00930e865b961d

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.0e92f460c297f8439e07515299107fe0.exe

Filesize
399KB

MD5
c7197cde8d8194ac2b1fdba700f0cac8

SHA1
4c5de9983998f3104f0c1cbb76768771b87620ad

SHA256
35869aacc2804ab41760f353563b9bdff822649bb728c7dcf65c5c2d578cc9a1

SHA512
f14e12de790d75aaf7ccadafd2e3785946eec6b2209e52d2815863a3bc3705cf02ab66da9eaad0737762b95ad37b770aaf71cd3a3b28a3430d00930e865b961d

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.0e92f460c297f8439e07515299107fe0.exe

Filesize
399KB

MD5
c7197cde8d8194ac2b1fdba700f0cac8

SHA1
4c5de9983998f3104f0c1cbb76768771b87620ad

SHA256
35869aacc2804ab41760f353563b9bdff822649bb728c7dcf65c5c2d578cc9a1

SHA512
f14e12de790d75aaf7ccadafd2e3785946eec6b2209e52d2815863a3bc3705cf02ab66da9eaad0737762b95ad37b770aaf71cd3a3b28a3430d00930e865b961d

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.0e92f460c297f8439e07515299107fe0.exe

Filesize
399KB

MD5
c7197cde8d8194ac2b1fdba700f0cac8

SHA1
4c5de9983998f3104f0c1cbb76768771b87620ad

SHA256
35869aacc2804ab41760f353563b9bdff822649bb728c7dcf65c5c2d578cc9a1

SHA512
f14e12de790d75aaf7ccadafd2e3785946eec6b2209e52d2815863a3bc3705cf02ab66da9eaad0737762b95ad37b770aaf71cd3a3b28a3430d00930e865b961d

Download Submit
memory/2724-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2724-3-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2724-4-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads