d1623793501149a1d1f6213c45cd6b79486887dd88f2b64ee01324b4beec20eb | Triage

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
17/11/2023, 05:09

Sharing

Report Analysis Logs

General

Target

NEAS.f98ea04fc20903e2b1412d52b5803320.exe
Size

184KB
MD5

f98ea04fc20903e2b1412d52b5803320
SHA1

68431d64671f30a41b47a475ca03f537425f2502
SHA256

d1623793501149a1d1f6213c45cd6b79486887dd88f2b64ee01324b4beec20eb
SHA512

cfad888c8e0826c871fa4014db8a4f4c7a4c52eb13250074f5958e0e9803da7def4029f4cf353c8e73f7b9e18c64be1e84107e44df95d09e03c2c98568ea494d
SSDEEP

3072:XEJ6VjoRKtqyd4/tX838bG59lvMqXviuv:XEGone4/A8K59lEqXviu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	2664	WerFault.exe	16

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2664	NEAS.f98ea04fc20903e2b1412d52b5803320.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2116	2664	NEAS.f98ea04fc20903e2b1412d52b5803320.exe	28
PID 2664 wrote to memory of 2116	2664	NEAS.f98ea04fc20903e2b1412d52b5803320.exe	28
PID 2664 wrote to memory of 2116	2664	NEAS.f98ea04fc20903e2b1412d52b5803320.exe	28
PID 2664 wrote to memory of 2116	2664	NEAS.f98ea04fc20903e2b1412d52b5803320.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.f98ea04fc20903e2b1412d52b5803320.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f98ea04fc20903e2b1412d52b5803320.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 244
  2⤵
  - Program crash
  PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads