418e2930537546fc65c3abab1cade24b0694c9e21df3930d4891e0e742e4f34c | Triage

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 15:20

Sharing

Report Analysis Logs

General

Target

NEAS.d434edffe07bb91d3a166a40626d3f80_JC.exe
Size

284KB
MD5

d434edffe07bb91d3a166a40626d3f80
SHA1

36eeb74085a0097253ba79bacb780ec32bfffd26
SHA256

418e2930537546fc65c3abab1cade24b0694c9e21df3930d4891e0e742e4f34c
SHA512

4634c33e8fe8ed3050e0af7fa223f88d3f1d8e0327829367a65790a4039ef81544b3ab28ce899c7c6f6ac25c351c5bd844638e67e6fe4d20e496e6e2b43ffeb3
SSDEEP

3072:x8RinudiP52xx67lLdhoiH11O7AJnD5tv:+kgiPA6RYW1Oarv

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2012	4616	WerFault.exe	85
3792	4616	WerFault.exe	85

C:\Users\Admin\AppData\Local\Temp\NEAS.d434edffe07bb91d3a166a40626d3f80_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d434edffe07bb91d3a166a40626d3f80_JC.exe"
1⤵
PID:4616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 220
  2⤵
  - Program crash
  PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 224
  2⤵
  - Program crash
  PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4616 -ip 4616
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4616 -ip 4616
1⤵
PID:3516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4616-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download