b931f34008a112398ad48f0bd4e2e955dd7385bcc5cafd41cdb2220f26bddc44 | Triage™

Analysis

max time kernel
56s
max time network
150s
platform
windows7_x64
resource
win7-20220331-en
submitted
08/04/2022, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Adjunto la confirmacion del pedido.exe
Size 1.0MB
Sample220408-m3dvdscee9
SHA256 b931f34008a112398ad48f0bd4e2e955dd7385bcc5cafd41cdb2220f26bddc44
MD5 f23cee6cf6de2de9b3d570a7f017c22b
SHA1 12b26e966bdb8e29734597d210c54d19509dbff8
SHA512 56465532903563e248ccfe2ffdee198e1b967b65d99f7c977bb7e65e84330acc1273afcb119b55c147ebb22a0588e8855e604d0a54c335096efb265308f18586
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
272	1116	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 272	1116	Adjunto la confirmacion del pedido.exe	29
PID 1116 wrote to memory of 272	1116	Adjunto la confirmacion del pedido.exe	29
PID 1116 wrote to memory of 272	1116	Adjunto la confirmacion del pedido.exe	29
PID 1116 wrote to memory of 272	1116	Adjunto la confirmacion del pedido.exe	29

C:\Users\Admin\AppData\Local\Temp\Adjunto la confirmacion del pedido.exe
"C:\Users\Admin\AppData\Local\Temp\Adjunto la confirmacion del pedido.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 1560
  2⤵
  - Program crash
  PID:272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Download