6adc540dc5716e768a90ebca5e02e80d2647e18ee4e2b21cd4a567aa81291695 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.b73ebdc870676ec38fdd9be7bae6ba30.exe
Size

264KB
MD5

b73ebdc870676ec38fdd9be7bae6ba30
SHA1

1627323a6ad08fd3394c1a3ed859c7f3c69de123
SHA256

6adc540dc5716e768a90ebca5e02e80d2647e18ee4e2b21cd4a567aa81291695
SHA512

58a51da134527d44d159d3ce7e6fcddc99d26984b4cf8c892750b30fc409ef8c28deb6489ab422bc507620799e919b991f942ffe95d31582e7d9c60be2a26cda
SSDEEP

3072:EC6xRyfFP0o35cc+rp/OrzXr4MKy3G7UEqMM6:EC6xRydsS+FgEn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1580	2800	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 1580	2800	NEAS.b73ebdc870676ec38fdd9be7bae6ba30.exe	28
PID 2800 wrote to memory of 1580	2800	NEAS.b73ebdc870676ec38fdd9be7bae6ba30.exe	28
PID 2800 wrote to memory of 1580	2800	NEAS.b73ebdc870676ec38fdd9be7bae6ba30.exe	28
PID 2800 wrote to memory of 1580	2800	NEAS.b73ebdc870676ec38fdd9be7bae6ba30.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.b73ebdc870676ec38fdd9be7bae6ba30.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b73ebdc870676ec38fdd9be7bae6ba30.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 36
  2⤵
  - Program crash
  PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2800-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download