d4da0fe2826f0e5145814ee0b247f3bc9924cb6d323a184a73ac39fee4d32ed9 | Triage

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 02:13

Sharing

Report Analysis Logs

General

Target

Comprovante.exe
Size

260KB
MD5

471f8d3f7bc7f53d704867b368ab978e
SHA1

2a8f95418eb76e3d3e39890511fb3cdd6b6aaf0f
SHA256

2424cc3a2b7c4fc7c56e61fbd87692c9f187fe60a45ad864ae2a459ea237b88a
SHA512

e7223de6fe36942867a9e9164738b118c109add0c7ee8c9f8ca3744ebc1917b8e0ea445f9f5629a1d12a637e08515048516b4cd0e134358e2dca97bdac4bd9c5
SSDEEP

6144:W/C6NWgQweHi9AcQvRVupQzS0XUNFhE++e:mC6NWgzeHi6vRQpKS+Uzm/e

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

Processes:

Comprovante.exe

description ioc process

File created C:\Program Files (x86)\2_D2S14S\D_214_.exe Comprovante.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2184 1968 WerFault.exe Comprovante.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Comprovante.exe

description	pid	process	target process
PID 1968 wrote to memory of 2184	1968	Comprovante.exe	WerFault.exe
PID 1968 wrote to memory of 2184	1968	Comprovante.exe	WerFault.exe
PID 1968 wrote to memory of 2184	1968	Comprovante.exe	WerFault.exe
PID 1968 wrote to memory of 2184	1968	Comprovante.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Comprovante.exe
"C:\Users\Admin\AppData\Local\Temp\Comprovante.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 392
2⤵
- Program crash
PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x0000000000330000-0x0000000000377000-memory.dmp

Filesize
284KB

Download