e7ac7c64889312c42876b74c7c4e7be0a383d98449dbc3d41eb9835bea79e0cd | Triage™

Analysis

max time kernel
11s
max time network
116s
platform
windows10_x64
resource
win10v20210410
submitted
18/08/2021, 06:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order_exe.exe
Size 381KB
Sample210818-fg84cdme3s
SHA256 e7ac7c64889312c42876b74c7c4e7be0a383d98449dbc3d41eb9835bea79e0cd
MD5 a922f9ed29b869017a10ca43e95325fd
SHA1 5bd9147c88341dc383f437bc473e2c866bcfc113
SHA512 74ec04819e2381c837b79828384c0272e979af73d7a7466c2e929bfa3a6a7c07283dbc1def55769b7f33a98f31a32be5243382c998feb93a12ee3556b16aadc9
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3700	Purchase Order_exe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 1792	3700	Purchase Order_exe.exe	76
PID 3700 wrote to memory of 1792	3700	Purchase Order_exe.exe	76
PID 3700 wrote to memory of 1792	3700	Purchase Order_exe.exe	76

C:\Users\Admin\AppData\Local\Temp\Purchase Order_exe.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order_exe.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\Temp\Purchase Order_exe.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order_exe.exe"
  2⤵
  PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3700-114-0x0000000002B40000-0x0000000002C8A000-memory.dmp

Download