ca352dbf3bc593ece2392e53a53a8d326367f59b887d528e8ec6648e1543edea | Triage

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 14:15

Sharing

Report Analysis Logs

General

Target

NEAS.9cb0bc306201afc5e384edbadbe64f50.exe
Size

188KB
MD5

9cb0bc306201afc5e384edbadbe64f50
SHA1

c16d23e9f4d239abecc80e19823c7001fb0a2958
SHA256

ca352dbf3bc593ece2392e53a53a8d326367f59b887d528e8ec6648e1543edea
SHA512

663889f031f0278be4228936613e55027993e25ae92c5ded62934af666fba2566be6bec2823ab251513baff1759390bbf5cca5be0c1b277922e7655e3f53a250
SSDEEP

768:fiVAVxXMxHLRQdDPHc/FM8YNfoKH1nRNK/1H5Yz:fzPXKlQdDPr8qH1nMi

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2784	2156	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2784	2156	NEAS.9cb0bc306201afc5e384edbadbe64f50.exe	28
PID 2156 wrote to memory of 2784	2156	NEAS.9cb0bc306201afc5e384edbadbe64f50.exe	28
PID 2156 wrote to memory of 2784	2156	NEAS.9cb0bc306201afc5e384edbadbe64f50.exe	28
PID 2156 wrote to memory of 2784	2156	NEAS.9cb0bc306201afc5e384edbadbe64f50.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.9cb0bc306201afc5e384edbadbe64f50.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9cb0bc306201afc5e384edbadbe64f50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 36
  2⤵
  - Program crash
  PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download