d7c81b22b82c19f2c3b05ba1b222e317975cc16f4900db415c8e723c7f2eff06 | Triage™

Analysis

max time kernel
55s
max time network
23s
platform
windows7_x64
resource
win7
submitted
14/10/2020, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
samples.exe
Size 681KB
Sample201014-rnvvdvgnws
SHA256 d7c81b22b82c19f2c3b05ba1b222e317975cc16f4900db415c8e723c7f2eff06
MD5 96eaa31af28c16ad4d9a2730a52a0b79
SHA1 acd2d5971eecefaa8b87c82646c9430900997cbf
SHA512 b118bf52badcaaa6dc76cba3f2eaf4fdb0f84fd24260cf2c3c894c3ef66c57a465b32a29b77537664a567644fe1b9b87ebd9baa97d10653d887a5b2b5a041d04
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1908	1124	samples.exe	28
PID 1124 wrote to memory of 1908	1124	samples.exe	28
PID 1124 wrote to memory of 1908	1124	samples.exe	28
PID 1124 wrote to memory of 1908	1124	samples.exe	28

C:\Users\Admin\AppData\Local\Temp\samples.exe
"C:\Users\Admin\AppData\Local\Temp\samples.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 456
  2⤵
  PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-1-0x0000000001ED0000-0x0000000001EE1000-memory.dmp

Download