0bbc06390e3dfc9e44bda66fbc1e08ef13cf3d0b0b49ae4e72305a840a352511 | Triage™

Analysis

max time kernel
5s
max time network
13s
platform
windows7_x64
resource
win7v20210408
submitted
09/08/2021, 05:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
P.O. 110689-08-2021,pdf.exe
Size 244KB
Sample210809-r593ebk63n
SHA256 0bbc06390e3dfc9e44bda66fbc1e08ef13cf3d0b0b49ae4e72305a840a352511
MD5 39ae9cdb090b0983c5577e095e489236
SHA1 40f1308a87fca711b6aef961dfb8fe753dd20960
SHA512 e3daed03b0360e96ba3745844bdb91555a881e2dfc28a4d2bc372a6a9cc4953297cac2d48b6f887f1124161e594d4ada65dfd07102abf64e2931214161d4a721
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1104	P.O. 110689-08-2021,pdf.exe
1104	P.O. 110689-08-2021,pdf.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2032	1104	P.O. 110689-08-2021,pdf.exe	27
PID 1104 wrote to memory of 2032	1104	P.O. 110689-08-2021,pdf.exe	27
PID 1104 wrote to memory of 2032	1104	P.O. 110689-08-2021,pdf.exe	27
PID 1104 wrote to memory of 2032	1104	P.O. 110689-08-2021,pdf.exe	27
PID 1104 wrote to memory of 2032	1104	P.O. 110689-08-2021,pdf.exe	27

C:\Users\Admin\AppData\Local\Temp\P.O. 110689-08-2021,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\P.O. 110689-08-2021,pdf.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\P.O. 110689-08-2021,pdf.exe"
  2⤵
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-60-0x00000000002D0000-0x00000000002D2000-memory.dmp

Download