81e70c0086d7ed9902668693d366301b526d0d6502d3318b02a9ca361a11e76c | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 19:55

Sharing

Report Analysis Logs

General

Target

NEAS.34e965ddbe77ca97f6ff81f94d59e980.exe
Size

116KB
MD5

34e965ddbe77ca97f6ff81f94d59e980
SHA1

8e0ebb79f10d8edf3afa9c1341fa29792832dd18
SHA256

81e70c0086d7ed9902668693d366301b526d0d6502d3318b02a9ca361a11e76c
SHA512

39c4b813d2e959396e5925662aa6d2c268c3aecb74380eee0d9bbdc0539548105d85562f559e5c0585bff8798d7012cf06e2b2f98005cbaf2214c99e328be817
SSDEEP

3072:XG3gnYqNEbF6tkJ2/G7c6Hegtg7+9g3ZkSrY+:XG3P6R7fNY

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	2364	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2152	2364	NEAS.34e965ddbe77ca97f6ff81f94d59e980.exe	28
PID 2364 wrote to memory of 2152	2364	NEAS.34e965ddbe77ca97f6ff81f94d59e980.exe	28
PID 2364 wrote to memory of 2152	2364	NEAS.34e965ddbe77ca97f6ff81f94d59e980.exe	28
PID 2364 wrote to memory of 2152	2364	NEAS.34e965ddbe77ca97f6ff81f94d59e980.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.34e965ddbe77ca97f6ff81f94d59e980.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.34e965ddbe77ca97f6ff81f94d59e980.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 36
  2⤵
  - Program crash
  PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads