031527224e74b82bf16e639c666134674ecc8a6e648fed2f68255617bd6a3b18 | Triage

Analysis

max time kernel
122s
max time network
170s
platform
windows7_x64
resource
win7v20210410
submitted
30-07-2021 15:25

Sharing

Report Analysis Logs

General

Target

Order.exe
Size

184KB
MD5

b48a1b6628f1f941e506d15013a72619
SHA1

4d6a9fb6ad5aa1b53440c2eb0806602fc164b0a2
SHA256

cf540119b481ff1a73efd8f50bc5942faaa46e79f9cb78d06b2b993ef4c921a4
SHA512

c74f5fb663cd9e34c234a78884a30399825ed4211d5c1a795bebc6fa2546ae02ba9ddf24e648fd251ac5a265131cd645855483aeb411892367858ac2a571f6be

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2024 set thread context of 1956	2024	Order.exe	26

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2024	Order.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1956	2024	Order.exe	26
PID 2024 wrote to memory of 1956	2024	Order.exe	26
PID 2024 wrote to memory of 1956	2024	Order.exe	26
PID 2024 wrote to memory of 1956	2024	Order.exe	26
PID 2024 wrote to memory of 1956	2024	Order.exe	26

C:\Users\Admin\AppData\Local\Temp\Order.exe
"C:\Users\Admin\AppData\Local\Temp\Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Order.exe"
  2⤵
  PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-62-0x0000000001C60000-0x0000000001C7A000-memory.dmp

Filesize
104KB

Download
memory/1956-63-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1956-64-0x0000000004641000-0x0000000004642000-memory.dmp

Filesize
4KB

Download
memory/2024-59-0x0000000076A81000-0x0000000076A83000-memory.dmp

Filesize
8KB

Download