001a1cdb54323a53fda69bcbb898a43005018314049fad54160161a3d9fb3ab5 | Triage

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 16:44

Sharing

Report Analysis Logs

General

Target

NEAS.794d9318978189a2ee0bde49b70b3970.exe
Size

880KB
MD5

794d9318978189a2ee0bde49b70b3970
SHA1

8a15225a1b240cc52be7912288993d923f362c59
SHA256

001a1cdb54323a53fda69bcbb898a43005018314049fad54160161a3d9fb3ab5
SHA512

b97ac0e4051d16d66b33407f1348ccf529814c29399ddb74088f16c69a0b7555c8894638f5246a5d358b1742b674bc807f7be6dfe52d76021796ed01b944ef90
SSDEEP

24576:lOUIwBixNBJBixNBV7EgSBixNBJBixNB:4iix7/ix710ix7/ix7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	2016	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 3032	2016	NEAS.794d9318978189a2ee0bde49b70b3970.exe	28
PID 2016 wrote to memory of 3032	2016	NEAS.794d9318978189a2ee0bde49b70b3970.exe	28
PID 2016 wrote to memory of 3032	2016	NEAS.794d9318978189a2ee0bde49b70b3970.exe	28
PID 2016 wrote to memory of 3032	2016	NEAS.794d9318978189a2ee0bde49b70b3970.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.794d9318978189a2ee0bde49b70b3970.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.794d9318978189a2ee0bde49b70b3970.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 140
  2⤵
  - Program crash
  PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2016-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download