525fa43cc91159f5fba36f2325310cff7a682736317fd935e808ba4e185e3aca | Triage

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 20:59

Sharing

Report Analysis Logs

General

Target

NEAS.866489052e6a06f8aa5940081a813180.exe
Size

256KB
MD5

866489052e6a06f8aa5940081a813180
SHA1

9d9f637d39f430d54610c12e9c9d82a231808eff
SHA256

525fa43cc91159f5fba36f2325310cff7a682736317fd935e808ba4e185e3aca
SHA512

1b91be3397145b7223b7afefd76a39473ec0a1fae6fc0b888d28148c260e1f62995ec42cf96147abc7483ecc3122c683dfb90e498a93b9814ac326a0451998a7
SSDEEP

1536:3e2zFtcirXA/lU9IOXAFjxAuS2LBwfi+TjRC/:bFqyazOIxAgBwf1TjY

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	3032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3060	3032	NEAS.866489052e6a06f8aa5940081a813180.exe	28
PID 3032 wrote to memory of 3060	3032	NEAS.866489052e6a06f8aa5940081a813180.exe	28
PID 3032 wrote to memory of 3060	3032	NEAS.866489052e6a06f8aa5940081a813180.exe	28
PID 3032 wrote to memory of 3060	3032	NEAS.866489052e6a06f8aa5940081a813180.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.866489052e6a06f8aa5940081a813180.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.866489052e6a06f8aa5940081a813180.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 36
  2⤵
  - Program crash
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download