8b402bb02ec8211eb98b09beb60ea62db552c98ecc5919337dbace8af8bc0f57

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/03/2025, 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Listado Facturas.exe
Size

7.9MB
MD5

e44441da8f8b45b56e6b46ab5ddf4736
SHA1

d8b09914d7e463e72ddc13206b86c3d90aa993c2
SHA256

10fb218b942d8e1e9e070b82f01ce72128a19e97158003b53686b4d7a03a8aa8
SHA512

84f5c7299e954d773ac2c65c3849dbf2bb4a4fefc395a8afc6cb30ee236d9d37d5cfb5caefdb7a906ea5a8a11884fb0c64483f2c454ac00232d79701676cfa20
SSDEEP

196608:8R1r9MalxTjLcUeLs8fk4kgQeo49tAQxVEkWxATVmVg5NsED5lO4:sria3TjYs8M4kPeo4fAHxsVSgw85

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3064	Listado Facturas.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	Listado Facturas.exe
Token: SeDebugPrivilege	3064	Listado Facturas.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2304	3064	Listado Facturas.exe	30
PID 3064 wrote to memory of 2304	3064	Listado Facturas.exe	30
PID 3064 wrote to memory of 2304	3064	Listado Facturas.exe	30

C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe
"C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3064 -s 608
  2⤵
  PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3064-0-0x000007FEF4EE3000-0x000007FEF4EE4000-memory.dmp

Filesize
4KB

Download
memory/3064-1-0x00000000009A0000-0x000000000118A000-memory.dmp

Filesize
7.9MB

Download
memory/3064-2-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/3064-3-0x000000001CB00000-0x000000001D2D4000-memory.dmp

Filesize
7.8MB

Download
memory/3064-4-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-7-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-5-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-9-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-11-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-13-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-15-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-17-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-19-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-21-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-67-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-65-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-63-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-61-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-59-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-1340-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/3064-57-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-55-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-53-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-1341-0x000000001D2D0000-0x000000001D9FC000-memory.dmp

Filesize
7.2MB

Download
memory/3064-1342-0x000000001DA00000-0x000000001E128000-memory.dmp

Filesize
7.2MB

Download
memory/3064-1343-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/3064-51-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-1344-0x0000000000940000-0x000000000098C000-memory.dmp

Filesize
304KB

Download
memory/3064-49-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-47-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-45-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-43-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-1345-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/3064-41-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-39-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-37-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-35-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-33-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-31-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-29-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-27-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-25-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-23-0x000000001CB00000-0x000000001D2CD000-memory.dmp

Filesize
7.8MB

Download
memory/3064-1346-0x000007FEF4EE3000-0x000007FEF4EE4000-memory.dmp

Filesize
4KB

Download
memory/3064-1347-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/3064-1348-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/3064-1349-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/3064-1350-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/3064-1351-0x0000000000780000-0x00000000007D4000-memory.dmp

Filesize
336KB

Download
memory/3064-1352-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/3064-1353-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download