7ce81b9b3f960d24617b4e766ca48e0e5b37e4181811ecdd0c706193dcabd350 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
18-11-2023 00:08

Sharing

Report Analysis Logs

General

Target

NEAS.ebd15dcd802e5f6cf398422345696590.exe
Size

260KB
MD5

ebd15dcd802e5f6cf398422345696590
SHA1

7e6d3ba7ce6fff0c6b0608c6ee8051d4d46af087
SHA256

7ce81b9b3f960d24617b4e766ca48e0e5b37e4181811ecdd0c706193dcabd350
SHA512

5ac2a3cf8fc1b5390e0c541372e3ab60f4bfba9a0849971605584a4c7ddb719114c2ccc5405f4e4fbbdc2eee89485f60e865e5782c93b74a9ceae260be44c6f8
SSDEEP

1536:rsASwKScoNSLDhJz6tiV9N+zL20gJi1i:rBSwx8Hh16tiV9gzL20WK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2108	1704	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2108	1704	NEAS.ebd15dcd802e5f6cf398422345696590.exe	28
PID 1704 wrote to memory of 2108	1704	NEAS.ebd15dcd802e5f6cf398422345696590.exe	28
PID 1704 wrote to memory of 2108	1704	NEAS.ebd15dcd802e5f6cf398422345696590.exe	28
PID 1704 wrote to memory of 2108	1704	NEAS.ebd15dcd802e5f6cf398422345696590.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.ebd15dcd802e5f6cf398422345696590.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ebd15dcd802e5f6cf398422345696590.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 36
  2⤵
  - Program crash
  PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download