52c06bcb8fad3ada3f6d6eeabff5f2a8fe7876a92bc12b1ff256d6daf1f29e56

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 23:54

Target

Comprobante.exe
Size

242KB
MD5

1c45f9793dcff0da91025fbf5bae5298
SHA1

d314a9f4e2ef9d88dad81726ce7027d26bf4a518
SHA256

52c06bcb8fad3ada3f6d6eeabff5f2a8fe7876a92bc12b1ff256d6daf1f29e56
SHA512

b5756936bbc3076358534628d2df304922857f4cb49d8fa67c06f4f64cc7750315bd6880bd64bfdf6b4cef3bbface162a1a3a1a381f3ca44adb5a8b7a226d9a4
SSDEEP

6144:OYbvMPmf2qbycSe7VeRbypp6yjGi3fw1/h8mCxP2u+WtI:jmmOySY4Gpvd3fa8mCxP2u+WW

Score

5^/10

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 1740	1744	Comprobante.exe	86
PID 1744 set thread context of 1576	1744	Comprobante.exe	87
PID 1744 set thread context of 316	1744	Comprobante.exe	88

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4508	1576	WerFault.exe	87
2524	1740	WerFault.exe	86
2428	316	WerFault.exe	88

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	Comprobante.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1740	1744	Comprobante.exe	86
PID 1744 wrote to memory of 1740	1744	Comprobante.exe	86
PID 1744 wrote to memory of 1740	1744	Comprobante.exe	86
PID 1744 wrote to memory of 1740	1744	Comprobante.exe	86
PID 1744 wrote to memory of 1740	1744	Comprobante.exe	86
PID 1744 wrote to memory of 1740	1744	Comprobante.exe	86
PID 1744 wrote to memory of 1740	1744	Comprobante.exe	86
PID 1744 wrote to memory of 1740	1744	Comprobante.exe	86
PID 1744 wrote to memory of 1576	1744	Comprobante.exe	87
PID 1744 wrote to memory of 1576	1744	Comprobante.exe	87
PID 1744 wrote to memory of 1576	1744	Comprobante.exe	87
PID 1744 wrote to memory of 1576	1744	Comprobante.exe	87
PID 1744 wrote to memory of 1576	1744	Comprobante.exe	87
PID 1744 wrote to memory of 1576	1744	Comprobante.exe	87
PID 1744 wrote to memory of 1576	1744	Comprobante.exe	87
PID 1744 wrote to memory of 1576	1744	Comprobante.exe	87
PID 1744 wrote to memory of 316	1744	Comprobante.exe	88
PID 1744 wrote to memory of 316	1744	Comprobante.exe	88
PID 1744 wrote to memory of 316	1744	Comprobante.exe	88
PID 1744 wrote to memory of 316	1744	Comprobante.exe	88
PID 1744 wrote to memory of 316	1744	Comprobante.exe	88
PID 1744 wrote to memory of 316	1744	Comprobante.exe	88
PID 1744 wrote to memory of 316	1744	Comprobante.exe	88
PID 1744 wrote to memory of 316	1744	Comprobante.exe	88

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1576 -ip 1576
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1740 -ip 1740
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 316 -ip 316
1⤵
PID:3580

memory/1744-0-0x000000007486E000-0x000000007486F000-memory.dmp

Filesize
4KB

Download
memory/1744-1-0x0000000000850000-0x0000000000896000-memory.dmp

Filesize
280KB

Download
memory/1744-2-0x0000000001290000-0x0000000001296000-memory.dmp

Filesize
24KB

Download
memory/1744-3-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/1744-4-0x00000000051E0000-0x0000000005220000-memory.dmp

Filesize
256KB

Download
memory/1744-5-0x00000000054E0000-0x000000000557C000-memory.dmp

Filesize
624KB

Download
memory/1744-6-0x0000000005B30000-0x00000000060D4000-memory.dmp

Filesize
5.6MB

Download
memory/1744-7-0x0000000005620000-0x00000000056B2000-memory.dmp

Filesize
584KB

Download
memory/1744-8-0x00000000052A0000-0x00000000052A6000-memory.dmp

Filesize
24KB

Download
memory/1744-13-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download