Analysis
- max time kernel
88s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
29/01/2024, 09:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
solicitud de cotización0089.xlsx.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
solicitud de cotización0089.xlsx.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
- Target solicitud de cotización0089.xlsx.exe
- Size 1.2MB
- Sample240129-ldmkkaeff7
- SHA256 c20765742b6d22e16299239e960d1c4e851fa9f12bd1b0696d4195f8890a6bf6
- MD5 968a9fe4fccd0723b5eb8bac04dfb668
- SHA1 b6ff6d9c28755b38c25c1fca3abcfdb54142aa56
- SHA512 26be94fcf3301be4a68021e4b1acf23dece83037fb94e054b8a05dd2118404e7bcfe306333a657b9995cb031b94a55a8aa742f577d38707b302faf169dd3de1b
- SSDEEP 24576:HAHnh+eWsN3skA4RV1Hom2KXcmtc611cIV4uDSnX:6h+ZkldoPKsac6ce
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/100-0-0x0000000000B60000-0x0000000000C94000-memory.dmp autoit_exe - Program crash 1 IoCs
pid pid_target Process procid_target 2444 100 WerFault.exe 25
Processes
-
C:\Users\Admin\AppData\Local\Temp\solicitud de cotización0089.xlsx.exe"C:\Users\Admin\AppData\Local\Temp\solicitud de cotización0089.xlsx.exe"1⤵PID:100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 5322⤵
- Program crash
PID:2444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 100 -ip 1001⤵PID:4824