32e40a6d96b44db7bc636ad0c8cdcab585c9e9744d33f42df00549049b31277e | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4e349760d318057515d0b48cbf2c8c10.exe
Size

260KB
MD5

4e349760d318057515d0b48cbf2c8c10
SHA1

7b42fd12ba258ecac2fa55152c02edf01d7b1c33
SHA256

32e40a6d96b44db7bc636ad0c8cdcab585c9e9744d33f42df00549049b31277e
SHA512

de2ded6d91669e9a6a97aee838f4c19be5fbc057fddb165dc8f9852937246ae7d013e31f51da7de50fb674d0f5ab2aec7c88c99a42141504a50b95bf82dac072
SSDEEP

3072:dC6xRyfFP0o35cc+rp4OBzuHrtG9MW3+3l2:dC6xRydsS+u6AtGDuM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	1636	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2224	1636	NEAS.4e349760d318057515d0b48cbf2c8c10.exe	28
PID 1636 wrote to memory of 2224	1636	NEAS.4e349760d318057515d0b48cbf2c8c10.exe	28
PID 1636 wrote to memory of 2224	1636	NEAS.4e349760d318057515d0b48cbf2c8c10.exe	28
PID 1636 wrote to memory of 2224	1636	NEAS.4e349760d318057515d0b48cbf2c8c10.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.4e349760d318057515d0b48cbf2c8c10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4e349760d318057515d0b48cbf2c8c10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 36
  2⤵
  - Program crash
  PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download