a85e694553ca227ac5cb89cc229850a4596f76eb5e7fd0267595e3fdedca52a4 | Triage

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 13:55

Sharing

Report Analysis Logs

General

Target

NEAS.24a740a4eb54c9382a7e6753ca53c6b0.exe
Size

401KB
MD5

24a740a4eb54c9382a7e6753ca53c6b0
SHA1

0def2692cbff8b8887a00d3cccd06c3d426f97e0
SHA256

a85e694553ca227ac5cb89cc229850a4596f76eb5e7fd0267595e3fdedca52a4
SHA512

2af14df6030425a61f84543dabe85a99fef410e2bee620385225816e505667e1686974d3c739b2652b8b31b274d173284fa79e2ee161bbb716055c5bbf151a86
SSDEEP

12288:GBFeGGzb2OMLfQBpwKiOb1am8D0vkSsPdu:Ws1bksBpPvbEmOSkSoU

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	1680	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1684	1680	NEAS.24a740a4eb54c9382a7e6753ca53c6b0.exe	28
PID 1680 wrote to memory of 1684	1680	NEAS.24a740a4eb54c9382a7e6753ca53c6b0.exe	28
PID 1680 wrote to memory of 1684	1680	NEAS.24a740a4eb54c9382a7e6753ca53c6b0.exe	28
PID 1680 wrote to memory of 1684	1680	NEAS.24a740a4eb54c9382a7e6753ca53c6b0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.24a740a4eb54c9382a7e6753ca53c6b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.24a740a4eb54c9382a7e6753ca53c6b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 152
  2⤵
  - Program crash
  PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-0-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1680-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download