9b1df4cbf562d19fdabc7033411935e951c1f39f3d77c60baab6ab16c5633b26 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
06/11/2023, 02:09

Sharing

Report Analysis Logs

General

Target

NEAS.5c087272c24f88cbc13030efa80ea2c0.exe
Size

128KB
MD5

5c087272c24f88cbc13030efa80ea2c0
SHA1

c802a7e870a20df632b36b046f0eec17318edaa0
SHA256

9b1df4cbf562d19fdabc7033411935e951c1f39f3d77c60baab6ab16c5633b26
SHA512

7ac99a8fe885476bad17f02118eeaf125f7f47f02a41ce34a566f8b26715d3bd1cc62dd38475f41aa7f8171d06240a7dd8a0a8ee23cee9588c7f8fac88ad31ce
SSDEEP

1536:+BZVtCBDmBrngvRXoXLSJNlE3G03zOW2+SZ:+nVIYn2RXo+PoG0DOW

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2596	1996	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2596	1996	NEAS.5c087272c24f88cbc13030efa80ea2c0.exe	28
PID 1996 wrote to memory of 2596	1996	NEAS.5c087272c24f88cbc13030efa80ea2c0.exe	28
PID 1996 wrote to memory of 2596	1996	NEAS.5c087272c24f88cbc13030efa80ea2c0.exe	28
PID 1996 wrote to memory of 2596	1996	NEAS.5c087272c24f88cbc13030efa80ea2c0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.5c087272c24f88cbc13030efa80ea2c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5c087272c24f88cbc13030efa80ea2c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 36
  2⤵
  - Program crash
  PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads