3fd5d3f31357295c5d1f367b9f229d4b634a9535634b7ba0e0926d85099913dc | Triage

Analysis

max time kernel
123s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 20:56

Sharing

Report Analysis Logs

General

Target

NEAS.5691e467feaab17d5643617e1063dc20.exe
Size

204KB
MD5

5691e467feaab17d5643617e1063dc20
SHA1

b227bfbeabbbb81f6966933c427bc70ecc951b8d
SHA256

3fd5d3f31357295c5d1f367b9f229d4b634a9535634b7ba0e0926d85099913dc
SHA512

4fa15aa22f27dfd8c54b000a6e883d7f7236f9952c8b92630ca1a3e4fd51ebe7514aa177323a31ba8b74d393a03619de196730b7df620dd01a8cbc77d6f4859b
SSDEEP

768:zm0PkFaP+HUNHBoAhSyxt9GNFNCm2PeMTyq8e2y:60y/07zSYeNSXV2y

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	1964	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2116	1964	NEAS.5691e467feaab17d5643617e1063dc20.exe	28
PID 1964 wrote to memory of 2116	1964	NEAS.5691e467feaab17d5643617e1063dc20.exe	28
PID 1964 wrote to memory of 2116	1964	NEAS.5691e467feaab17d5643617e1063dc20.exe	28
PID 1964 wrote to memory of 2116	1964	NEAS.5691e467feaab17d5643617e1063dc20.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.5691e467feaab17d5643617e1063dc20.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5691e467feaab17d5643617e1063dc20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 36
  2⤵
  - Program crash
  PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download