ceb5abb7bb6795d52167a5c24e934a91cdf662e6bb068e325a84174afb5df03a | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
28-10-2023 20:14

Sharing

Report Analysis Logs

General

Target

NEAS.cf48e5b218ee6cba8f7d63690067da50.exe
Size

424KB
MD5

cf48e5b218ee6cba8f7d63690067da50
SHA1

136333ae850ba7bc7657f0b35086a5c8ef0c74fe
SHA256

ceb5abb7bb6795d52167a5c24e934a91cdf662e6bb068e325a84174afb5df03a
SHA512

83497e477b7d2ffb21b26b45bee7fe64b94e0713b86ccdd3f0a93000059c8aa0d77c130c8a90ac2e2b2c53ca552109c8ee1fd9f2729e77698bb7aa2f7daa3001
SSDEEP

6144:7qp1NsdmE4T2Ns+dUrnoixei9xBUfzIk4l0LTGYx:eE4P9xBUfck4+Rx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	2036	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2516	2036	NEAS.cf48e5b218ee6cba8f7d63690067da50.exe	28
PID 2036 wrote to memory of 2516	2036	NEAS.cf48e5b218ee6cba8f7d63690067da50.exe	28
PID 2036 wrote to memory of 2516	2036	NEAS.cf48e5b218ee6cba8f7d63690067da50.exe	28
PID 2036 wrote to memory of 2516	2036	NEAS.cf48e5b218ee6cba8f7d63690067da50.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.cf48e5b218ee6cba8f7d63690067da50.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cf48e5b218ee6cba8f7d63690067da50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 36
  2⤵
  - Program crash
  PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads