Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2023, 20:11

General

  • Target

    NEAS.ec868f29a0a61a130f0aa6ec2d8cb970.exe

  • Size

    248KB

  • MD5

    ec868f29a0a61a130f0aa6ec2d8cb970

  • SHA1

    7a189bec5c3b76641d962a21d64edf0dee1d9d4b

  • SHA256

    2dc67d31e2e877f70e73daaa8e19fe1e454ac8d751fdf834d7a53f009d418017

  • SHA512

    76fc6ccccd311c746029a47081a5b398a594021ba88d9ca5b58200752e4aa5995c879d9c8ffb9e8988d993cd8be2f16ecaaf949b801f3eafcb307b94af1d483c

  • SSDEEP

    384:vMAiXefG+vEK473K6PhvrR3FxfFCHJpDsCe7ouSzRNRg2knH1psa8R9Tk4CKd1y6:tiufvvYhxAHJpDMwepsO7ZuMUrf+qj

Score
3/10

Malware Config

Signatures

  • Program crash 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.ec868f29a0a61a130f0aa6ec2d8cb970.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.ec868f29a0a61a130f0aa6ec2d8cb970.exe"
    1⤵
      PID:4564
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 220
        2⤵
        • Program crash
        PID:4232
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 224
        2⤵
        • Program crash
        PID:1432
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4564 -ip 4564
      1⤵
        PID:544
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4564 -ip 4564
        1⤵
          PID:2628

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4564-0-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB