242045c07ffb6427b046939045d9312f3beaa954ef3ec60316247f7dfdfbca3e | Triage™

Analysis

max time kernel
52s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
17/12/2020, 06:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Customer Order, Images, Spec.exe
Size 1.1MB
Sample201217-p62tefmdv2
SHA256 242045c07ffb6427b046939045d9312f3beaa954ef3ec60316247f7dfdfbca3e
MD5 bc1817b978084e9a9755639ed307f8c7
SHA1 7a1fcf1f88c118ac69ced2c7023a73c7c7a98c54
SHA512 c237539857f8f7df5a9825898666f95d8471da94248eac11962c284220ca220a6818afbc2aabf74afa7f76e6b066519fa4ca36feefbcd67d439b44a165ec2ca1
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1332	1584	Customer Order, Images, Spec.exe	29
PID 1584 wrote to memory of 1332	1584	Customer Order, Images, Spec.exe	29
PID 1584 wrote to memory of 1332	1584	Customer Order, Images, Spec.exe	29
PID 1584 wrote to memory of 1332	1584	Customer Order, Images, Spec.exe	29

C:\Users\Admin\AppData\Local\Temp\Customer Order, Images, Spec.exe
"C:\Users\Admin\AppData\Local\Temp\Customer Order, Images, Spec.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 444
  2⤵
  PID:1332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1332-3-0x0000000001E60000-0x0000000001E71000-memory.dmp

Download