30ac3c20aa73bbb4f41aa641851d17a57388063188d0da40a7f4cc6ebe15bdf5 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 02:39

Sharing

Report Analysis Logs

General

Target

NEAS.6a4238cb7a43cf421a63cb14966d7220.exe
Size

248KB
MD5

6a4238cb7a43cf421a63cb14966d7220
SHA1

3ac37b9cc14d05882d37d3a4748863ea5ecae21c
SHA256

30ac3c20aa73bbb4f41aa641851d17a57388063188d0da40a7f4cc6ebe15bdf5
SHA512

46eec8c34d831f8dc911c5838b4586952a25bc24c76d87a483eab325c6a141f9bbacf8076315deb6d184df1c1c00ddad7a5847a2cb96ba8dc99dfa1021ba5012
SSDEEP

1536:0sASwKScoNSLDhESCYaMOfimXgMIIFbNk:0BSwx8HhESCYUflXbbNk

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	2892	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2380	2892	NEAS.6a4238cb7a43cf421a63cb14966d7220.exe	28
PID 2892 wrote to memory of 2380	2892	NEAS.6a4238cb7a43cf421a63cb14966d7220.exe	28
PID 2892 wrote to memory of 2380	2892	NEAS.6a4238cb7a43cf421a63cb14966d7220.exe	28
PID 2892 wrote to memory of 2380	2892	NEAS.6a4238cb7a43cf421a63cb14966d7220.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.6a4238cb7a43cf421a63cb14966d7220.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6a4238cb7a43cf421a63cb14966d7220.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 36
  2⤵
  - Program crash
  PID:2380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2892-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download