cf269203bdad4b5675cc947003542e4f4ec6257223ab86cc7c8abdfc7d89b13f | Triage

Analysis

max time kernel
49s
max time network
17s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 03:17

Sharing

Report Analysis Logs

General

Target

NezurLoader.exe
Size

71KB
MD5

858aec1e5d6c068cbc99167b5f9b7c6f
SHA1

392d9d7218285cfe2d96c01503a60aea0c6535d1
SHA256

cf269203bdad4b5675cc947003542e4f4ec6257223ab86cc7c8abdfc7d89b13f
SHA512

6b052aa4ede7596217e96f57434609b8c069b0c8e7c0da3e7535f3e68ebddd2e4b5225911a18ae64fd23e6e869c9579940f3bade5a9c57a6c089a2923b0b0ec7
SSDEEP

384:ix1BWsK2AVb+Uv3B0lWhESfzKn+nQJS2S68tQzWJq5XXSjwc:iod2SO5XS0c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	1460	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2184	1460	NezurLoader.exe	28
PID 1460 wrote to memory of 2184	1460	NezurLoader.exe	28
PID 1460 wrote to memory of 2184	1460	NezurLoader.exe	28
PID 1460 wrote to memory of 2184	1460	NezurLoader.exe	28

C:\Users\Admin\AppData\Local\Temp\NezurLoader.exe
"C:\Users\Admin\AppData\Local\Temp\NezurLoader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 580
  2⤵
  - Program crash
  PID:2184

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-0-0x0000000001060000-0x000000000106A000-memory.dmp

Filesize
40KB

Download
memory/1460-1-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download
memory/1460-2-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/1460-3-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download