ceb5abb7bb6795d52167a5c24e934a91cdf662e6bb068e325a84174afb5df03a | Triage

Analysis

max time kernel
127s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2023, 20:14

Sharing

Report Analysis Logs

General

Target

NEAS.cf48e5b218ee6cba8f7d63690067da50.exe
Size

424KB
MD5

cf48e5b218ee6cba8f7d63690067da50
SHA1

136333ae850ba7bc7657f0b35086a5c8ef0c74fe
SHA256

ceb5abb7bb6795d52167a5c24e934a91cdf662e6bb068e325a84174afb5df03a
SHA512

83497e477b7d2ffb21b26b45bee7fe64b94e0713b86ccdd3f0a93000059c8aa0d77c130c8a90ac2e2b2c53ca552109c8ee1fd9f2729e77698bb7aa2f7daa3001
SSDEEP

6144:7qp1NsdmE4T2Ns+dUrnoixei9xBUfzIk4l0LTGYx:eE4P9xBUfck4+Rx

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4668	4404	WerFault.exe	86
884	4404	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 4668	4404	NEAS.cf48e5b218ee6cba8f7d63690067da50.exe	92
PID 4404 wrote to memory of 4668	4404	NEAS.cf48e5b218ee6cba8f7d63690067da50.exe	92
PID 4404 wrote to memory of 4668	4404	NEAS.cf48e5b218ee6cba8f7d63690067da50.exe	92

C:\Users\Admin\AppData\Local\Temp\NEAS.cf48e5b218ee6cba8f7d63690067da50.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cf48e5b218ee6cba8f7d63690067da50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 224
  2⤵
  - Program crash
  PID:4668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 224
  2⤵
  - Program crash
  PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4404 -ip 4404
1⤵
PID:4576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads