Analysis

  • max time kernel
    122s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    19/07/2023, 12:47

General

  • Target

    Confirmación de transferencia.exe

  • Size

    590KB

  • MD5

    23e2e7bd3d1d30d4881b382d10a54c9c

  • SHA1

    a75a3fc37c081a8e36eb46a64d1673e541369782

  • SHA256

    1a1c58b80969ae187cde83fd32586d6072f8b66eae0dd3ae81c7b0d015d5c308

  • SHA512

    493fdd35c6db8574d10f2dfdd19040fbdaca9bae7599393a9cec93c3fde1f775804ed8994b6d37c3171f52e61a7beb1afad300a0aa93d92abb1f53c878996d9b

  • SSDEEP

    12288:pyPYPfY7hJGELu3yqwhy5kD8KeNjIqhlVSKZ2jv:MPYPgXqCqwE5uze+qfD2j

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Confirmación de transferencia.exe
    "C:\Users\Admin\AppData\Local\Temp\Confirmación de transferencia.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 680
      2⤵
      • Program crash
      PID:2180

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2476-54-0x0000000074830000-0x0000000074F1E000-memory.dmp

          Filesize

          6.9MB

        • memory/2476-55-0x0000000000190000-0x000000000022A000-memory.dmp

          Filesize

          616KB

        • memory/2476-56-0x0000000004970000-0x00000000049B0000-memory.dmp

          Filesize

          256KB

        • memory/2476-57-0x00000000004B0000-0x00000000004BE000-memory.dmp

          Filesize

          56KB

        • memory/2476-58-0x0000000074830000-0x0000000074F1E000-memory.dmp

          Filesize

          6.9MB

        • memory/2476-59-0x0000000004970000-0x00000000049B0000-memory.dmp

          Filesize

          256KB

        • memory/2476-60-0x0000000000660000-0x000000000066A000-memory.dmp

          Filesize

          40KB