2f8daf0f7d0ba0b573b93f3e4ffb75e157a0e78be8a07bde8325dbd0efe42b6b | Triage™

Analysis

max time kernel
123s
max time network
129s
platform
windows7_x64
resource
win7
submitted
14/10/2020, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20200715 Raaziq International Pvt Ltd.pdf.exe
Size 575KB
Sample201014-njstqkbwpn
SHA256 2f8daf0f7d0ba0b573b93f3e4ffb75e157a0e78be8a07bde8325dbd0efe42b6b
MD5 5660db9547062891e7d36558f435be50
SHA1 15af7203d4f37d121a55745df838965560bdab8b
SHA512 a5a9cb1e7067c3c735796a76f45d3af1b678dde6528734f47559a39fd70ef151605bd89b2b2bc983533d6f1a83feb6c7b6245ca6a6e4b526225dcd3912214bb5
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1552	1440	20200715 Raaziq International Pvt Ltd.pdf.exe	28
PID 1440 wrote to memory of 1552	1440	20200715 Raaziq International Pvt Ltd.pdf.exe	28
PID 1440 wrote to memory of 1552	1440	20200715 Raaziq International Pvt Ltd.pdf.exe	28
PID 1440 wrote to memory of 1552	1440	20200715 Raaziq International Pvt Ltd.pdf.exe	28

C:\Users\Admin\AppData\Local\Temp\20200715 Raaziq International Pvt Ltd.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\20200715 Raaziq International Pvt Ltd.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 456
  2⤵
  PID:1552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-1-0x0000000001D70000-0x0000000001D81000-memory.dmp

Download