f4ca65e152fb782fe1e4b56625f482f87592be42e7bb7f82ce8e438fa31ad97c | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 08:58

Sharing

Report Analysis Logs

General

Target

Nezur_Interface.exe
Size

1.1MB
MD5

93ecc71a1210ab64ba16746a44d89cf8
SHA1

d12ddf03218332e40a9939ece6e238225262abb5
SHA256

af1a4bcb352d75cca2eacc8e6d3269234a7b3c27d25cae0283544a456959e022
SHA512

4fc67e98b35581faefe614edcc9b012213158e1327cf374af3867130a7ca3bc1dfbbfa8ea26af2a05217a6b0bb09d82316e7b4e00cb4b57be9c45668ca1628c9
SSDEEP

12288:xPWyRv0uhCeMzFxhaSelVJDp2f7K33nQ3WcNoyUQY2g0S9t:QFLaSebJw63QNNoy1YO2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2504	2084	Nezur_Interface.exe	30
PID 2084 wrote to memory of 2504	2084	Nezur_Interface.exe	30
PID 2084 wrote to memory of 2504	2084	Nezur_Interface.exe	30

C:\Users\Admin\AppData\Local\Temp\Nezur_Interface.exe
"C:\Users\Admin\AppData\Local\Temp\Nezur_Interface.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2084 -s 504
  2⤵
  PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-0-0x000007FEF55A3000-0x000007FEF55A4000-memory.dmp

Filesize
4KB

Download
memory/2084-1-0x0000000000B60000-0x0000000000C8A000-memory.dmp

Filesize
1.2MB

Download
memory/2084-2-0x000007FEF55A3000-0x000007FEF55A4000-memory.dmp

Filesize
4KB

Download