7fa4ef5925f7374a93494b97a6ab43b0951c2d504972bbf43f9d29398e55481f | Triage

Resubmissions

11-02-2021 15:52

210211-akqfznyg92 8

11-02-2021 15:49

210211-epse3jscqs 10

Analysis

max time kernel
597s
max time network
599s
platform
windows10_x64
resource
win10v20201028
submitted
11-02-2021 15:52

Sharing

Report Analysis Logs

General

Target

LawyerCustomerComplaint.exe
Size

671KB
MD5

60772f2f4ba787c019ff29dc9c747381
SHA1

98d4e1c4ae2e19da51f4543cb2cff51a4a7f2b3e
SHA256

7fa4ef5925f7374a93494b97a6ab43b0951c2d504972bbf43f9d29398e55481f
SHA512

93c38dd200d3bbac351e0e2debaa8f5468be12c07e4a3f0c518b8c91a1977e60791669b1c86fa67a748fd91e4a02029f6a83ee419a1875236646999a4b3beee4

Score

8^/10

dave

Malware Config

Signatures

Dave packer 1 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

Processes:

resource	yara_rule
behavioral1/memory/492-4-0x00000000023D0000-0x00000000023FD000-memory.dmp	dave

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

LawyerCustomerComplaint.exe

pid process

492 LawyerCustomerComplaint.exe
492 LawyerCustomerComplaint.exe

C:\Users\Admin\AppData\Local\Temp\LawyerCustomerComplaint.exe
"C:\Users\Admin\AppData\Local\Temp\LawyerCustomerComplaint.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/492-2-0x0000000002400000-0x000000000242F000-memory.dmp

Filesize
188KB

Download
memory/492-3-0x0000000002430000-0x000000000245E000-memory.dmp

Filesize
184KB

Download
memory/492-4-0x00000000023D0000-0x00000000023FD000-memory.dmp

Filesize
180KB

Download
memory/492-5-0x0000000003750000-0x0000000003B50000-memory.dmp

Filesize
4.0MB

Download