9d4c9eecd8ce267a6a241cbbcf925b063e38f2d45b72e950a22549f613b1f9a2 | Triage

Analysis

max time kernel
121s
max time network
143s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0b4ea0a14088dca1ad52f080851ec8b0.exe
Size

260KB
MD5

0b4ea0a14088dca1ad52f080851ec8b0
SHA1

553f9aa30e11697c8b21a6df24af0e832ad8b913
SHA256

9d4c9eecd8ce267a6a241cbbcf925b063e38f2d45b72e950a22549f613b1f9a2
SHA512

ae20e40c42a339068f5245303b7feee6b5f203f84d1ed15df711ae682adfa94a2bf54b7fa3df972966772a5773dfcd2c20b387ee94da82b9f7074307168021eb
SSDEEP

3072:KX4vfioe3m3OwJ+dTTTTTTTT4DtfRKB3AabLWG:KtjWOwDDtfRKB3A4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	2332	WerFault.exe	8

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2268	2332	NEAS.0b4ea0a14088dca1ad52f080851ec8b0.exe	23
PID 2332 wrote to memory of 2268	2332	NEAS.0b4ea0a14088dca1ad52f080851ec8b0.exe	23
PID 2332 wrote to memory of 2268	2332	NEAS.0b4ea0a14088dca1ad52f080851ec8b0.exe	23
PID 2332 wrote to memory of 2268	2332	NEAS.0b4ea0a14088dca1ad52f080851ec8b0.exe	23

C:\Users\Admin\AppData\Local\Temp\NEAS.0b4ea0a14088dca1ad52f080851ec8b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0b4ea0a14088dca1ad52f080851ec8b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 36
  2⤵
  - Program crash
  PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download