181232a9e88c12ab1b1ec7228c1a9f4703b44017fac6934a142361e37985ff15 | Triage

Analysis

max time kernel
34s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 06:08

Sharing

Report Analysis Logs

General

Target

comprobante.pdf.exe
Size

42KB
MD5

37dffb8fc4927092f3e166aee2afa828
SHA1

13f38874c91e6186afdb694c896cf029d3875824
SHA256

181232a9e88c12ab1b1ec7228c1a9f4703b44017fac6934a142361e37985ff15
SHA512

ada8050509e45d104fb5414bc3970655701bbe85212aea01086cd95d6a127234ef0eab26c0891280586b72fc66fc9095b7ad33f988fc6f78d8acaa6032187e07
SSDEEP

768:hev5NGja1TxGIP+tZS+XZg/0kt+Hrqt5RYVMcORgU24vSyiRj:MNG21T4IP+tZPX2MM+LqtfY9ORGhyi5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	1748	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1912	1748	comprobante.pdf.exe	28
PID 1748 wrote to memory of 1912	1748	comprobante.pdf.exe	28
PID 1748 wrote to memory of 1912	1748	comprobante.pdf.exe	28

C:\Users\Admin\AppData\Local\Temp\comprobante.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\comprobante.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1748 -s 716
  2⤵
  - Program crash
  PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1748-54-0x0000000000F80000-0x0000000000F8E000-memory.dmp

Filesize
56KB

Download
memory/1748-55-0x000007FEFB8F1000-0x000007FEFB8F3000-memory.dmp

Filesize
8KB

Download