4ad33db217cd28e94e816da762375ed676740f21eee05f60be7785b27665cfbd

Analysis

Target
Bank Swift.doc.exe
Size 473KB
Sample220120-mbc4sahec4
SHA256 4ad33db217cd28e94e816da762375ed676740f21eee05f60be7785b27665cfbd
MD5 cb2f90f127deb8055bc861a7ef11cab8
SHA1 396c379fd25a09f327e74ac595b554ec01522d16
SHA512 5ca1ec2a74cbd6856ac674c698e16de1dcbfeeef9b344de741369cdf7d0cc885468c21086534de78b3e569ccbd9e14497beedc001d73b6c9b159677956bd8de9
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1864	2244	Bank Swift.doc.exe	57
PID 2244 wrote to memory of 1864	2244	Bank Swift.doc.exe	57
PID 2244 wrote to memory of 1864	2244	Bank Swift.doc.exe	57
PID 2244 wrote to memory of 1864	2244	Bank Swift.doc.exe	57
PID 2244 wrote to memory of 1864	2244	Bank Swift.doc.exe	57

C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank Swift.doc.exe"
  2⤵
  PID:1864

memory/2244-133-0x0000000000600000-0x000000000067E000-memory.dmp

Download

memory/2244-134-0x0000000005700000-0x0000000005CA4000-memory.dmp

Download

memory/2244-135-0x0000000005020000-0x00000000050B2000-memory.dmp

Download

memory/2244-136-0x00000000050D0000-0x00000000050DA000-memory.dmp

Download

memory/2244-137-0x0000000005150000-0x00000000056F4000-memory.dmp

Download

memory/2244-138-0x0000000007590000-0x000000000762C000-memory.dmp

Download