7891ae9d0d99198c2fa2e77bb5f937b22ffa4ffa83c6fbba6a012b7054b4b1b9 | Triage™

Analysis

max time kernel
93s
max time network
99s
platform
windows7_x64
resource
win7
submitted
14/10/2020, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PRICE with SHORTEST DELIVERY TIME.exe
Size 776KB
Sample201014-zck8rrrjgn
SHA256 7891ae9d0d99198c2fa2e77bb5f937b22ffa4ffa83c6fbba6a012b7054b4b1b9
MD5 374090dd4787607038e3f71543cd25d9
SHA1 4539865ea44ded6f5493a5a17e0b118ede027cb1
SHA512 2cc5c5e16848d493c5ade8ad4f7e2448723c73465e4475cc1886a407a7ad7035a50a5079eafbd2c0afa78470d97e8ccacb25699fd30ef2c7d8449b5f00434257
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1628	1044	PRICE with SHORTEST DELIVERY TIME.exe	28
PID 1044 wrote to memory of 1628	1044	PRICE with SHORTEST DELIVERY TIME.exe	28
PID 1044 wrote to memory of 1628	1044	PRICE with SHORTEST DELIVERY TIME.exe	28
PID 1044 wrote to memory of 1628	1044	PRICE with SHORTEST DELIVERY TIME.exe	28

C:\Users\Admin\AppData\Local\Temp\PRICE with SHORTEST DELIVERY TIME.exe
"C:\Users\Admin\AppData\Local\Temp\PRICE with SHORTEST DELIVERY TIME.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 456
  2⤵
  PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-1-0x0000000001DB0000-0x0000000001DC1000-memory.dmp

Download