c07976412c7f6efc8b5114ba92f40775ea093783d0e393e48b9ddbcae049abb2 | Triage

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
07-07-2022 16:30

Sharing

Report Analysis Logs

General

Target

guía de carga___________________________________________________________________________.exe
Size

706KB
MD5

aaf87a2b7c55a4a146eeb0c6052ae78c
SHA1

d925a5ecb4d91a106791dd61d8797b3f069d7aac
SHA256

c07976412c7f6efc8b5114ba92f40775ea093783d0e393e48b9ddbcae049abb2
SHA512

485508002f265f49a46ca25f72543f1aac66b315530dcdc5ebadd88706cfff5647ff573986443779658efc396ed729a70f39db4eb3b3cd7fc6bc9525a9cbfd70

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1016 1984 WerFault.exe guía de carga___________________________________________________________________________.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

guía de carga___________________________________________________________________________.exe

description	pid	process	target process
PID 1984 wrote to memory of 1016	1984	guía de carga___________________________________________________________________________.exe	WerFault.exe
PID 1984 wrote to memory of 1016	1984	guía de carga___________________________________________________________________________.exe	WerFault.exe
PID 1984 wrote to memory of 1016	1984	guía de carga___________________________________________________________________________.exe	WerFault.exe
PID 1984 wrote to memory of 1016	1984	guía de carga___________________________________________________________________________.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\guía de carga___________________________________________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\guía de carga___________________________________________________________________________.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 592
2⤵
- Program crash
PID:1016

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-56-0x0000000000000000-mapping.dmp

Download
memory/1984-54-0x0000000000850000-0x0000000000906000-memory.dmp

Filesize
728KB

Download
memory/1984-55-0x0000000000910000-0x000000000097A000-memory.dmp

Filesize
424KB

Download