8b95345212bd6fd41f6ad95a4ce20d68ebad498474fd9758b5ae9afd2a929859 | Triage

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.1ea3314c88d9b444330b8163d713ccf0.exe
Size

204KB
MD5

1ea3314c88d9b444330b8163d713ccf0
SHA1

cd4e5cec5b38cbf564dc5b2a85a7ac1cd48345a4
SHA256

8b95345212bd6fd41f6ad95a4ce20d68ebad498474fd9758b5ae9afd2a929859
SHA512

708bb718c0b969b8352f24dc66b2f02f4f064d9ffdf57b4279aa84b6f6c2ae7cba8e5600233ea51f662fabd1251a795dfde75a80e04531774a2029a3a2cdff6d
SSDEEP

1536:idao6FSGHLYhCyd5xakT6lr9WI26BQ1tmRQ:i+xHMcm5vT6zWI3Qee

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	2628	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2056	2628	NEAS.1ea3314c88d9b444330b8163d713ccf0.exe	28
PID 2628 wrote to memory of 2056	2628	NEAS.1ea3314c88d9b444330b8163d713ccf0.exe	28
PID 2628 wrote to memory of 2056	2628	NEAS.1ea3314c88d9b444330b8163d713ccf0.exe	28
PID 2628 wrote to memory of 2056	2628	NEAS.1ea3314c88d9b444330b8163d713ccf0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.1ea3314c88d9b444330b8163d713ccf0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1ea3314c88d9b444330b8163d713ccf0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 36
  2⤵
  - Program crash
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download