08d9c37aa3dd2fa9ffaaacc25cf53cf1537141b1b06895dad22e0ae78408a83f | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 19:56

Sharing

Report Analysis Logs

General

Target

NEAS.2407804aeb259b269c3e01bf62042ce0.exe
Size

119KB
MD5

2407804aeb259b269c3e01bf62042ce0
SHA1

5a5e5e93ea87cab16824c2e2592b2297b877d9c9
SHA256

08d9c37aa3dd2fa9ffaaacc25cf53cf1537141b1b06895dad22e0ae78408a83f
SHA512

07723f9f8a6589e48959cc009123db2539aa6ea4ca06914ea08808ab86d24d789de63da9dfd957fd9cf95237afa4f77dd0c4f0deb8e443da8da8e3f6df43b1aa
SSDEEP

3072:ecYETfwyCkvZeDaJWpxntI4ioW8ClFCqW:ecDDCewDg4x0hCT

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	2180	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2640	2180	NEAS.2407804aeb259b269c3e01bf62042ce0.exe	17
PID 2180 wrote to memory of 2640	2180	NEAS.2407804aeb259b269c3e01bf62042ce0.exe	17
PID 2180 wrote to memory of 2640	2180	NEAS.2407804aeb259b269c3e01bf62042ce0.exe	17
PID 2180 wrote to memory of 2640	2180	NEAS.2407804aeb259b269c3e01bf62042ce0.exe	17

C:\Users\Admin\AppData\Local\Temp\NEAS.2407804aeb259b269c3e01bf62042ce0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2407804aeb259b269c3e01bf62042ce0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 36
  2⤵
  - Program crash
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download