c20765742b6d22e16299239e960d1c4e851fa9f12bd1b0696d4195f8890a6bf6

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 09:25

Target
solicitud de cotización0089.xlsx.exe
Size 1.2MB
Sample240129-ldmkkaeff7
SHA256 c20765742b6d22e16299239e960d1c4e851fa9f12bd1b0696d4195f8890a6bf6
MD5 968a9fe4fccd0723b5eb8bac04dfb668
SHA1 b6ff6d9c28755b38c25c1fca3abcfdb54142aa56
SHA512 26be94fcf3301be4a68021e4b1acf23dece83037fb94e054b8a05dd2118404e7bcfe306333a657b9995cb031b94a55a8aa742f577d38707b302faf169dd3de1b
SSDEEP 24576:HAHnh+eWsN3skA4RV1Hom2KXcmtc611cIV4uDSnX:6h+ZkldoPKsac6ce
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1756-0-0x0000000000AC0000-0x0000000000BF4000-memory.dmp	autoit_exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2060	1756	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2060	1756	solicitud de cotización0089.xlsx.exe	28
PID 1756 wrote to memory of 2060	1756	solicitud de cotización0089.xlsx.exe	28
PID 1756 wrote to memory of 2060	1756	solicitud de cotización0089.xlsx.exe	28
PID 1756 wrote to memory of 2060	1756	solicitud de cotización0089.xlsx.exe	28

C:\Users\Admin\AppData\Local\Temp\solicitud de cotización0089.xlsx.exe
"C:\Users\Admin\AppData\Local\Temp\solicitud de cotización0089.xlsx.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 236
  2⤵
  - Program crash
  PID:2060

memory/1756-0-0x0000000000AC0000-0x0000000000BF4000-memory.dmp

Download