2cae0733832b43c9ce4bf7f564d573162fdd88040ce6a75a782fcbfd71916644 | Triage

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 04:45

Sharing

Report Analysis Logs

General

Target

NEAS.3773ddd3cc69f3a948c60b4b9c2f9ce0.exe
Size

52KB
MD5

3773ddd3cc69f3a948c60b4b9c2f9ce0
SHA1

bf680260bfc38177b7ec0639849cbc5e9b6e334c
SHA256

2cae0733832b43c9ce4bf7f564d573162fdd88040ce6a75a782fcbfd71916644
SHA512

f225914fbcbccfb1cc4ff440e74ab83dd6c44390fb81404dd13ccb1e87c33b41b2c2e8f0c86902e488d64cc447dbc599fb17a63a1fdf744345e0fbc6c1c8b22b
SSDEEP

384:sx2KzC6+1ihcz/A78FBPgyppYQ7m7HZp:T6wTz/A780cppiHZp

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	536	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 2760	536	NEAS.3773ddd3cc69f3a948c60b4b9c2f9ce0.exe	28
PID 536 wrote to memory of 2760	536	NEAS.3773ddd3cc69f3a948c60b4b9c2f9ce0.exe	28
PID 536 wrote to memory of 2760	536	NEAS.3773ddd3cc69f3a948c60b4b9c2f9ce0.exe	28
PID 536 wrote to memory of 2760	536	NEAS.3773ddd3cc69f3a948c60b4b9c2f9ce0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.3773ddd3cc69f3a948c60b4b9c2f9ce0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3773ddd3cc69f3a948c60b4b9c2f9ce0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 36
  2⤵
  - Program crash
  PID:2760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download