cc9a998abd10fdbe87d4065cb36f43163eb9d6516e6a679ae67b9c73a55a6e12 | Triage

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
16-11-2023 23:05

Sharing

Report Analysis Logs

General

Target

NEAS.4c765fe2e14bdcb76f1bafaad6c38a20.exe
Size

256KB
MD5

4c765fe2e14bdcb76f1bafaad6c38a20
SHA1

e0a07aa813d35e26e8eda43c38109507fe306846
SHA256

cc9a998abd10fdbe87d4065cb36f43163eb9d6516e6a679ae67b9c73a55a6e12
SHA512

8557bee9a9faba5a56b97598a8a2132672090f87d593087323989e1564128c492a6dcb25544f9026b1982375e465ffb03d176eb67df7ea9339c8b4da083ce72f
SSDEEP

1536:wccYH/Gnc+hmlJQek83K2Ltwfi+TjRC/:cYt7Qek83Xtwf1TjY

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1796	3064	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1796	3064	NEAS.4c765fe2e14bdcb76f1bafaad6c38a20.exe	28
PID 3064 wrote to memory of 1796	3064	NEAS.4c765fe2e14bdcb76f1bafaad6c38a20.exe	28
PID 3064 wrote to memory of 1796	3064	NEAS.4c765fe2e14bdcb76f1bafaad6c38a20.exe	28
PID 3064 wrote to memory of 1796	3064	NEAS.4c765fe2e14bdcb76f1bafaad6c38a20.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.4c765fe2e14bdcb76f1bafaad6c38a20.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4c765fe2e14bdcb76f1bafaad6c38a20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 36
  2⤵
  - Program crash
  PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3064-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download