627df201b9c05c58cea69ff20712fe8a97d5068bd40713735ea90b846592e23f | Triage

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12-11-2023 21:43

Sharing

Report Analysis Logs

General

Target

NEAS.323a8df2e46aa2395a6ee79546d24c40.exe
Size

204KB
MD5

323a8df2e46aa2395a6ee79546d24c40
SHA1

204537cc1d0d309b6d3971d8089918019e4f72aa
SHA256

627df201b9c05c58cea69ff20712fe8a97d5068bd40713735ea90b846592e23f
SHA512

4d7688def1fe0a1bd377f99690cb0034e459fa95d2bfdbc074cf1255694f871d7209b73fec787607b137f48556759c3b0d485bd6c7351076f25bac0f81525bc8
SSDEEP

1536:qfR5P1OBvXURW43guCI6q9JacisbgU4ZARQ:qTtZW4TCIVwciAWZAe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2708	2184	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2708	2184	NEAS.323a8df2e46aa2395a6ee79546d24c40.exe	27
PID 2184 wrote to memory of 2708	2184	NEAS.323a8df2e46aa2395a6ee79546d24c40.exe	27
PID 2184 wrote to memory of 2708	2184	NEAS.323a8df2e46aa2395a6ee79546d24c40.exe	27
PID 2184 wrote to memory of 2708	2184	NEAS.323a8df2e46aa2395a6ee79546d24c40.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.323a8df2e46aa2395a6ee79546d24c40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.323a8df2e46aa2395a6ee79546d24c40.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 36
  2⤵
  - Program crash
  PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download