fa4a988ca1c69e3dcd3069d5262021406b0320e33cd3191d0fa0df7377106e62

Analysis

max time kernel
143s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.66355f2ef59517cf6d3e8948ec60c140_JC.exe
Size

442KB
MD5

66355f2ef59517cf6d3e8948ec60c140
SHA1

4ffc9c0ce9c06121cd4a727e0d31d8bd9dd28dbb
SHA256

fa4a988ca1c69e3dcd3069d5262021406b0320e33cd3191d0fa0df7377106e62
SHA512

87a8a8a073bf18e95ce7233558e017919131225bc79a96e9bd2f0ed64d6ad89c7984bfdc6b89bf95675e680863d8bf64685ee5c89b8e1cc7fdebe9393d357c47
SSDEEP

12288:E463EnmKukmbCTyXvZf1VWLVWEmBfDpYnmqukEp1f:bMEnm2yXR2m19YnmxZ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2752	WerFault.exe
2752	WerFault.exe
2752	WerFault.exe
2752	WerFault.exe
2752	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2212	WerFault.exe	13

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2212	NEAS.66355f2ef59517cf6d3e8948ec60c140_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2752	2212	NEAS.66355f2ef59517cf6d3e8948ec60c140_JC.exe	29
PID 2212 wrote to memory of 2752	2212	NEAS.66355f2ef59517cf6d3e8948ec60c140_JC.exe	29
PID 2212 wrote to memory of 2752	2212	NEAS.66355f2ef59517cf6d3e8948ec60c140_JC.exe	29
PID 2212 wrote to memory of 2752	2212	NEAS.66355f2ef59517cf6d3e8948ec60c140_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.66355f2ef59517cf6d3e8948ec60c140_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.66355f2ef59517cf6d3e8948ec60c140_JC.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 544
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\NEAS.66355f2ef59517cf6d3e8948ec60c140_JC.exe

Filesize
448KB

MD5
13d528547f9c061d4611d0641a07aa46

SHA1
052623de982176f61ad088c6968650f6d8c49514

SHA256
f56854b33c8cd4c34758c054494b59ec7cdc1239c5c849a76aa3a1ef57222dea

SHA512
58d8e7b4291b2034661607ff9bdcec90d66326cae68d7ea382ae9ab6b4f724200a6bc2a6bf16e3491c1ac83c0025b0f6f30f02f2b76bb2c2660aaa179c294b79

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.66355f2ef59517cf6d3e8948ec60c140_JC.exe

Filesize
448KB

MD5
13d528547f9c061d4611d0641a07aa46

SHA1
052623de982176f61ad088c6968650f6d8c49514

SHA256
f56854b33c8cd4c34758c054494b59ec7cdc1239c5c849a76aa3a1ef57222dea

SHA512
58d8e7b4291b2034661607ff9bdcec90d66326cae68d7ea382ae9ab6b4f724200a6bc2a6bf16e3491c1ac83c0025b0f6f30f02f2b76bb2c2660aaa179c294b79

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.66355f2ef59517cf6d3e8948ec60c140_JC.exe

Filesize
448KB

MD5
13d528547f9c061d4611d0641a07aa46

SHA1
052623de982176f61ad088c6968650f6d8c49514

SHA256
f56854b33c8cd4c34758c054494b59ec7cdc1239c5c849a76aa3a1ef57222dea

SHA512
58d8e7b4291b2034661607ff9bdcec90d66326cae68d7ea382ae9ab6b4f724200a6bc2a6bf16e3491c1ac83c0025b0f6f30f02f2b76bb2c2660aaa179c294b79

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.66355f2ef59517cf6d3e8948ec60c140_JC.exe

Filesize
448KB

MD5
13d528547f9c061d4611d0641a07aa46

SHA1
052623de982176f61ad088c6968650f6d8c49514

SHA256
f56854b33c8cd4c34758c054494b59ec7cdc1239c5c849a76aa3a1ef57222dea

SHA512
58d8e7b4291b2034661607ff9bdcec90d66326cae68d7ea382ae9ab6b4f724200a6bc2a6bf16e3491c1ac83c0025b0f6f30f02f2b76bb2c2660aaa179c294b79

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.66355f2ef59517cf6d3e8948ec60c140_JC.exe

Filesize
448KB

MD5
13d528547f9c061d4611d0641a07aa46

SHA1
052623de982176f61ad088c6968650f6d8c49514

SHA256
f56854b33c8cd4c34758c054494b59ec7cdc1239c5c849a76aa3a1ef57222dea

SHA512
58d8e7b4291b2034661607ff9bdcec90d66326cae68d7ea382ae9ab6b4f724200a6bc2a6bf16e3491c1ac83c0025b0f6f30f02f2b76bb2c2660aaa179c294b79

Download Submit
memory/2212-0-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2212-4-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2212-3-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2212-31-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2212-32-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads