0d03382dc9f8a0cbe7657da9f41c7ae26073bcebb74094468acd7cf31e546829 | Triage™

Analysis

max time kernel
54s
max time network
13s
platform
windows7_x64
resource
win7v20201028
submitted
17/12/2020, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BL COPY.exe
Size 1.1MB
Sample201217-akht474wmn
SHA256 0d03382dc9f8a0cbe7657da9f41c7ae26073bcebb74094468acd7cf31e546829
MD5 4d80615f96b90391394f32d176f125af
SHA1 db5f21f41c4c5d7f4585e57f010a8f024a7900fb
SHA512 a5887c11e3306eda09b11899a1b66dc8de89796b3f20088b83fab24c5ff0c4c774954da632640090dac2f660711d863fa1efd7235d96b7c1078709ae2a16faf8
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1528	1640	BL COPY.exe	29
PID 1640 wrote to memory of 1528	1640	BL COPY.exe	29
PID 1640 wrote to memory of 1528	1640	BL COPY.exe	29
PID 1640 wrote to memory of 1528	1640	BL COPY.exe	29

C:\Users\Admin\AppData\Local\Temp\BL COPY.exe
"C:\Users\Admin\AppData\Local\Temp\BL COPY.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 480
  2⤵
  PID:1528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1528-3-0x0000000001D40000-0x0000000001D51000-memory.dmp

Download