548a56a8561e017d98d7c207236ec0e072a33636fc5ecec193ba5ace0e2e8a05 | Triage™

Analysis

max time kernel
122s
max time network
125s
platform
windows10_x64
resource
win10
submitted
01/07/2020, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sudhir PO 31051,pdf.exe
Size 363KB
Sample200701-k1kaes3kr2
SHA256 548a56a8561e017d98d7c207236ec0e072a33636fc5ecec193ba5ace0e2e8a05
MD5 faf4b45bf5be885c21b44c4dc9d473b3
SHA1 8adeaca1e56f63b8b027056ea7d5ec6409e8e10c
SHA512 507720334358d92300a7621f2b8120aa169a0aea269a83c156ffb86bd23d2a0fd10ab7ce3f10ca0cf006fae2058d6f9062cbc3794a814d54e5ccca6c774f4fa1
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 3292	976	Sudhir PO 31051,pdf.exe	67
PID 976 wrote to memory of 3292	976	Sudhir PO 31051,pdf.exe	67
PID 976 wrote to memory of 3292	976	Sudhir PO 31051,pdf.exe	67
PID 976 wrote to memory of 3292	976	Sudhir PO 31051,pdf.exe	67
PID 976 wrote to memory of 3292	976	Sudhir PO 31051,pdf.exe	67
PID 976 wrote to memory of 3292	976	Sudhir PO 31051,pdf.exe	67
PID 976 wrote to memory of 3292	976	Sudhir PO 31051,pdf.exe	67
PID 976 wrote to memory of 3292	976	Sudhir PO 31051,pdf.exe	67
PID 976 wrote to memory of 3292	976	Sudhir PO 31051,pdf.exe	67
PID 976 wrote to memory of 3292	976	Sudhir PO 31051,pdf.exe	67
PID 976 wrote to memory of 3292	976	Sudhir PO 31051,pdf.exe	67

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 976 set thread context of 3292	976	Sudhir PO 31051,pdf.exe	67

C:\Users\Admin\AppData\Local\Temp\Sudhir PO 31051,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Sudhir PO 31051,pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:976
- C:\Users\Admin\AppData\Local\Temp\Sudhir PO 31051,pdf.exe
  "{path}"
  2⤵
  PID:3292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3292-0-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/3292-2-0x0000000000400000-0x0000000000554000-memory.dmp

Download