7428fe8f9b06cd14e6cc31b213c33ca43b854cc4ebf90df6a71b0c9d317b5f3c | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 12:22

Sharing

Report Analysis Logs

General

Target

NEAS.e2d7924178f6cdd326862e86f8528c60.exe
Size

260KB
MD5

e2d7924178f6cdd326862e86f8528c60
SHA1

5daaf247e54f586bb4cb0c7fc6c90575afc7fc8b
SHA256

7428fe8f9b06cd14e6cc31b213c33ca43b854cc4ebf90df6a71b0c9d317b5f3c
SHA512

6d4230aa5d251df9ad0ee5b6cc65203c1d4b4e5f47492346a9aa5ca88a4458436ac96696f53a4a11ce0ffcd4e88681c2524fd4306aa71c2ef31127ecfb1bc967
SSDEEP

1536:DX+GrxPcGcxH5OcTmAoiVCN+zL20gJi1i:D5xPLcPOqoiVCgzL20WK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	2944	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2000	2944	NEAS.e2d7924178f6cdd326862e86f8528c60.exe	28
PID 2944 wrote to memory of 2000	2944	NEAS.e2d7924178f6cdd326862e86f8528c60.exe	28
PID 2944 wrote to memory of 2000	2944	NEAS.e2d7924178f6cdd326862e86f8528c60.exe	28
PID 2944 wrote to memory of 2000	2944	NEAS.e2d7924178f6cdd326862e86f8528c60.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.e2d7924178f6cdd326862e86f8528c60.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e2d7924178f6cdd326862e86f8528c60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 36
  2⤵
  - Program crash
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2944-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download