afd34bbcb2f23723f06c6cfcca2d802b15b78cbb6d74b4cdefd49b8b230c1f4f | Triage™

Analysis

max time kernel
62s
max time network
8s
platform
windows7_x64
resource
win7
submitted
14/10/2020, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Inquiry No 3308.exe
Size 534KB
Sample201014-sr7c1k87yx
SHA256 afd34bbcb2f23723f06c6cfcca2d802b15b78cbb6d74b4cdefd49b8b230c1f4f
MD5 2cdc1b5f91094744f775388069b3e363
SHA1 1e3311c6ec92ad10c32c543f57716fe005fa53f3
SHA512 2f4070a569c558741c72014f3d37c02ae63f7fef37ba6ef6886d3b3c908f8813fafadc4c07365e97fd598cc71618710e807b996496e36dcf8e126ca4e8ca94c5
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1628	1544	Inquiry No 3308.exe	28
PID 1544 wrote to memory of 1628	1544	Inquiry No 3308.exe	28
PID 1544 wrote to memory of 1628	1544	Inquiry No 3308.exe	28
PID 1544 wrote to memory of 1628	1544	Inquiry No 3308.exe	28

C:\Users\Admin\AppData\Local\Temp\Inquiry No 3308.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry No 3308.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 456
  2⤵
  PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-1-0x0000000001DF0000-0x0000000001E01000-memory.dmp

Download