a2e772a2b72091fc5996f64198684e85e9d521f620d435c90e36d3327ad44592 | Triage™

Analysis

max time kernel
64s
max time network
15s
platform
windows7_x64
resource
win7v200722
submitted
14/10/2020, 05:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NOAH 2_crypted.exe
Size 530KB
Sample201014-v4vshrkqse
SHA256 a2e772a2b72091fc5996f64198684e85e9d521f620d435c90e36d3327ad44592
MD5 947dd659a81c8ed26f8ed6ed0c675014
SHA1 6126c640f6b4ec2141fd6ed1cabb1c3d65201427
SHA512 5def2e9caf14e8a54a53d1967d7a76f3ae24a1583708899abf77de14d6a99f376c03f48c0370d360f450a2074761deabed1ee147708f5bf0090c3025472bad7f
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 556	1240	NOAH 2_crypted.exe	28
PID 1240 wrote to memory of 556	1240	NOAH 2_crypted.exe	28
PID 1240 wrote to memory of 556	1240	NOAH 2_crypted.exe	28
PID 1240 wrote to memory of 556	1240	NOAH 2_crypted.exe	28

C:\Users\Admin\AppData\Local\Temp\NOAH 2_crypted.exe
"C:\Users\Admin\AppData\Local\Temp\NOAH 2_crypted.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 456
  2⤵
  PID:556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-1-0x0000000001DF0000-0x0000000001E01000-memory.dmp

Download