dc3beb8d8630b8f3d6f1904165df83c664074ae27cb6cc0493dca0e4b033bc57 | Triage

Analysis

max time kernel
118s
max time network
137s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4b74c803b511ac25f7bc5b2631e48d90.exe
Size

204KB
MD5

4b74c803b511ac25f7bc5b2631e48d90
SHA1

cb690e2f6d295b4fa4a3a151d8e47e1df5ac337f
SHA256

dc3beb8d8630b8f3d6f1904165df83c664074ae27cb6cc0493dca0e4b033bc57
SHA512

2a67b1cd39a542da82baea513e0de8899b1743764222b6992449e89b3e8d4071f74d41357929ac507b39e460a13e56e7e45cb21d5e9ebc255dbff580ed0bac06
SSDEEP

1536:3quwU80RQ41XixMHIVNLJtPgl+dx62LF:3H5RQ4Sx4IVlPRF

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2096	1828	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2096	1828	NEAS.4b74c803b511ac25f7bc5b2631e48d90.exe	27
PID 1828 wrote to memory of 2096	1828	NEAS.4b74c803b511ac25f7bc5b2631e48d90.exe	27
PID 1828 wrote to memory of 2096	1828	NEAS.4b74c803b511ac25f7bc5b2631e48d90.exe	27
PID 1828 wrote to memory of 2096	1828	NEAS.4b74c803b511ac25f7bc5b2631e48d90.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.4b74c803b511ac25f7bc5b2631e48d90.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4b74c803b511ac25f7bc5b2631e48d90.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 36
  2⤵
  - Program crash
  PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1828-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download