5abafac7a19c68e532050cfcf9da01dfd78d1b0be25ff9c7033dd9b9b85883de | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.88759b1d01707a0b33ed8958c80ea640.exe
Size

230KB
MD5

88759b1d01707a0b33ed8958c80ea640
SHA1

7498f73d51ce7431a5191144de0532bbc32db07f
SHA256

5abafac7a19c68e532050cfcf9da01dfd78d1b0be25ff9c7033dd9b9b85883de
SHA512

01854feb2b2f098fddcf1619174db7129d15810a4edd20023f21a4ea6de65fb937d394a0fb8405a81a30a8f1c98b69f8a68457a83cd73796e65a2ee1978198d3
SSDEEP

3072:Qh/hYFEKZE1XeyFv5pTPurYnwDoQJ3vUKcWJ:JIeyFxZBtQpfJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	2180	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2100	2180	NEAS.88759b1d01707a0b33ed8958c80ea640.exe	28
PID 2180 wrote to memory of 2100	2180	NEAS.88759b1d01707a0b33ed8958c80ea640.exe	28
PID 2180 wrote to memory of 2100	2180	NEAS.88759b1d01707a0b33ed8958c80ea640.exe	28
PID 2180 wrote to memory of 2100	2180	NEAS.88759b1d01707a0b33ed8958c80ea640.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.88759b1d01707a0b33ed8958c80ea640.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.88759b1d01707a0b33ed8958c80ea640.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 36
  2⤵
  - Program crash
  PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2180-1-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download