b2f6e7e1fc7a1841ed0eda64537a13babd91d933f1e4f9140b8ae70db3ec6ad8 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/11/2022, 20:00

Sharing

Report Analysis Logs

General

Target

FACTURA_.exe
Size

657KB
MD5

56ae83862d17f1c0992048aee1a66236
SHA1

1677eb68958b88dab03d26146a5f966ae55624ce
SHA256

ef22b7c6c43652d25c1cd3e8d2dbcb6b35bd41fb405925bb9175814ababf5729
SHA512

784ba6d8fa084c3c041f3135fa1d710911dcb424763cf9833ff8d8ad2456849fef3d533c5c5b28812d5faa4f6e06c41c38440de2ef433ad32e14ecd2df71123b
SSDEEP

12288:Mfsf26N6ouHH1JQ2iNBw29GfSPPVusJ3aGp9I7pKxuazaBMgIvGdkdYeQ:TN5u1+15GUwsJ3ZG7+ull

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
808	1500	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 808	1500	FACTURA_.exe	27
PID 1500 wrote to memory of 808	1500	FACTURA_.exe	27
PID 1500 wrote to memory of 808	1500	FACTURA_.exe	27
PID 1500 wrote to memory of 808	1500	FACTURA_.exe	27

C:\Users\Admin\AppData\Local\Temp\FACTURA_.exe
"C:\Users\Admin\AppData\Local\Temp\FACTURA_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 576
  2⤵
  - Program crash
  PID:808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1500-54-0x0000000000170000-0x000000000021A000-memory.dmp

Filesize
680KB

Download