80e086390fedcc42fd5ebdc27852f682024f51487b13ccf98859a41531fdfd57 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 03:26

Sharing

Report Analysis Logs

General

Target

NEAS.18c85aecabce4234f33b1f417e153fd0.exe
Size

272KB
MD5

18c85aecabce4234f33b1f417e153fd0
SHA1

629976a210e3590904ebbfc9d53ed03f8a9083ad
SHA256

80e086390fedcc42fd5ebdc27852f682024f51487b13ccf98859a41531fdfd57
SHA512

6da0f310692df3d98aa38af0684d98418d4fcc11b3d917ec26f07f7dd61d400ef5b359646f83dd3864259363ec8683b4564f7b626abcc3dcb37afd8b33b82e3f
SSDEEP

3072:zW5bKF5FeAQq4CxPAPgxed6BYudlNPMA:zFFzPIyedZwlNPj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1920	1164	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1920	1164	NEAS.18c85aecabce4234f33b1f417e153fd0.exe	28
PID 1164 wrote to memory of 1920	1164	NEAS.18c85aecabce4234f33b1f417e153fd0.exe	28
PID 1164 wrote to memory of 1920	1164	NEAS.18c85aecabce4234f33b1f417e153fd0.exe	28
PID 1164 wrote to memory of 1920	1164	NEAS.18c85aecabce4234f33b1f417e153fd0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.18c85aecabce4234f33b1f417e153fd0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.18c85aecabce4234f33b1f417e153fd0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 36
  2⤵
  - Program crash
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1164-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download