67ce061bac5dd35217eebc864b76f730cdab413ed6620660b80e95dec5868d3f | Triage

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
07-07-2022 19:12

Sharing

Report Analysis Logs

General

Target

factura comercial.exe
Size

1.8MB
MD5

95b1a3cfa2d4df2598682cbc945a0544
SHA1

daad0dcf697838a0d2209490d0382370248d8647
SHA256

67ce061bac5dd35217eebc864b76f730cdab413ed6620660b80e95dec5868d3f
SHA512

c5dd2da04fb99f900ebc8945028c4e0bde6f26404840d07751db98407811da3220d92c791686ab5e2eed18a68994b60becc10b3c4e84dde7ad96b7ff645f8fea

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1620 1548 WerFault.exe factura comercial.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

factura comercial.exe

description	pid	process	target process
PID 1548 wrote to memory of 1620	1548	factura comercial.exe	WerFault.exe
PID 1548 wrote to memory of 1620	1548	factura comercial.exe	WerFault.exe
PID 1548 wrote to memory of 1620	1548	factura comercial.exe	WerFault.exe
PID 1548 wrote to memory of 1620	1548	factura comercial.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\factura comercial.exe
"C:\Users\Admin\AppData\Local\Temp\factura comercial.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 592
  2⤵
  - Program crash
  PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-54-0x00000000003A0000-0x000000000056A000-memory.dmp

Filesize
1.8MB

Download
memory/1548-55-0x0000000000570000-0x00000000005DA000-memory.dmp

Filesize
424KB

Download
memory/1620-56-0x0000000000000000-mapping.dmp

Download