4c2f87b50e2b1c92077ae25d2ded4d857a0c2c20c277e7d73b312e0b9cfba970 | Triage

Analysis

max time kernel
136s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2023 04:59

Sharing

Report Analysis Logs

General

Target

NEAS.b4f872836b9ded2b336e8f5b883d16d0.exe
Size

244KB
MD5

b4f872836b9ded2b336e8f5b883d16d0
SHA1

a713b01225ba459db32e99ed9e86a3a561c45f99
SHA256

4c2f87b50e2b1c92077ae25d2ded4d857a0c2c20c277e7d73b312e0b9cfba970
SHA512

8e42f61f9a5246d1d6bedba80ade226da3c07a64da1db91f313c4c6dfa82889acb5cc41719679ef1a994888239a1636b9edc6753361c5e0f384a8965edd83542
SSDEEP

3072:xllL7O86s/g7I080MaB4mf8B8Br87JE8:N+v90KMaB4mu

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
508	5088	WerFault.exe	64
5076	5088	WerFault.exe	64

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 508	5088	NEAS.b4f872836b9ded2b336e8f5b883d16d0.exe	92
PID 5088 wrote to memory of 508	5088	NEAS.b4f872836b9ded2b336e8f5b883d16d0.exe	92
PID 5088 wrote to memory of 508	5088	NEAS.b4f872836b9ded2b336e8f5b883d16d0.exe	92

C:\Users\Admin\AppData\Local\Temp\NEAS.b4f872836b9ded2b336e8f5b883d16d0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b4f872836b9ded2b336e8f5b883d16d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 224
  2⤵
  - Program crash
  PID:508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 224
  2⤵
  - Program crash
  PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5088 -ip 5088
1⤵
PID:1072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5088-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download