bb5f2f7206b2288f507165b534b72933124bef07122acdec4581942cf51df1fc | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 12:55

Sharing

Report Analysis Logs

General

Target

NEAS.ce0316f760456fb8138232fe799d7fe0.exe
Size

143KB
MD5

ce0316f760456fb8138232fe799d7fe0
SHA1

123b0479740ed00e77bc48306e0dd43f31983847
SHA256

bb5f2f7206b2288f507165b534b72933124bef07122acdec4581942cf51df1fc
SHA512

6b6f6f35e6cce6fa6b7a40c7e6f35ffee1afff446612fa63bbace957269bb8e20a3adfde143b8aa7127e23a5d4d128654718558fb24dd204dde5613e4229b6a8
SSDEEP

3072:sJhdIyIzWL4m7YMj9Om+PO10+1th/nrriowyuGKZf:sYzFsym2OG2viRy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	2192	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1716	2192	NEAS.ce0316f760456fb8138232fe799d7fe0.exe	28
PID 2192 wrote to memory of 1716	2192	NEAS.ce0316f760456fb8138232fe799d7fe0.exe	28
PID 2192 wrote to memory of 1716	2192	NEAS.ce0316f760456fb8138232fe799d7fe0.exe	28
PID 2192 wrote to memory of 1716	2192	NEAS.ce0316f760456fb8138232fe799d7fe0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.ce0316f760456fb8138232fe799d7fe0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ce0316f760456fb8138232fe799d7fe0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 552
  2⤵
  - Program crash
  PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x00000000001F0000-0x000000000021A000-memory.dmp

Filesize
168KB

Download
memory/2192-1-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/2192-2-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download