4c2f87b50e2b1c92077ae25d2ded4d857a0c2c20c277e7d73b312e0b9cfba970 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 04:59

Sharing

Report Analysis Logs

General

Target

NEAS.b4f872836b9ded2b336e8f5b883d16d0.exe
Size

244KB
MD5

b4f872836b9ded2b336e8f5b883d16d0
SHA1

a713b01225ba459db32e99ed9e86a3a561c45f99
SHA256

4c2f87b50e2b1c92077ae25d2ded4d857a0c2c20c277e7d73b312e0b9cfba970
SHA512

8e42f61f9a5246d1d6bedba80ade226da3c07a64da1db91f313c4c6dfa82889acb5cc41719679ef1a994888239a1636b9edc6753361c5e0f384a8965edd83542
SSDEEP

3072:xllL7O86s/g7I080MaB4mf8B8Br87JE8:N+v90KMaB4mu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1888	2924	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1888	2924	NEAS.b4f872836b9ded2b336e8f5b883d16d0.exe	28
PID 2924 wrote to memory of 1888	2924	NEAS.b4f872836b9ded2b336e8f5b883d16d0.exe	28
PID 2924 wrote to memory of 1888	2924	NEAS.b4f872836b9ded2b336e8f5b883d16d0.exe	28
PID 2924 wrote to memory of 1888	2924	NEAS.b4f872836b9ded2b336e8f5b883d16d0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.b4f872836b9ded2b336e8f5b883d16d0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b4f872836b9ded2b336e8f5b883d16d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 36
  2⤵
  - Program crash
  PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2924-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download