67cfd80f670a8444cb33472804d6f63e8947ccc09b13a509c18877c5786c38c0 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 02:24

Sharing

Report Analysis Logs

General

Target

NEAS.7676331c3a7d737b18fc73b5fc4d1e00.exe
Size

640KB
MD5

7676331c3a7d737b18fc73b5fc4d1e00
SHA1

92ce0eeace9d95631c0151710ae32dc53a91291f
SHA256

67cfd80f670a8444cb33472804d6f63e8947ccc09b13a509c18877c5786c38c0
SHA512

ea830f4fa32e65df94a605105d1f9c3eeca548fffde3a0e09db00ad80cdc29676097b4dd6cf269a3c6ad13013da306a25c91282fdda9cbb616d0d150624334c0
SSDEEP

6144:hU0NrUY3EWtIelZgmLKS3yVYoZcOLBDlBRcpa:hUqd3EOHlumDICOR/R

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1864	536	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1864	536	NEAS.7676331c3a7d737b18fc73b5fc4d1e00.exe	28
PID 536 wrote to memory of 1864	536	NEAS.7676331c3a7d737b18fc73b5fc4d1e00.exe	28
PID 536 wrote to memory of 1864	536	NEAS.7676331c3a7d737b18fc73b5fc4d1e00.exe	28
PID 536 wrote to memory of 1864	536	NEAS.7676331c3a7d737b18fc73b5fc4d1e00.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.7676331c3a7d737b18fc73b5fc4d1e00.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7676331c3a7d737b18fc73b5fc4d1e00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 36
  2⤵
  - Program crash
  PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-0-0x0000000000F40000-0x0000000000FE0000-memory.dmp

Filesize
640KB

Download