c7530feafbd5d59f5595f6819a27676d0a9166e8570abf94acf41c59537ce364

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/03/2025, 00:20

Target

comprobante de pago swift.exe
Size

710KB
MD5

b58e47e4e59039345c3d5cf2174e57de
SHA1

54f16d3adcde3a9549b7f7deb6170d0f65397215
SHA256

162c5e37fafdeef1e2d1d1d3d49585ab38451f54251833e7a10b4b3476d4f380
SHA512

7e1d2f2f61e1bc12943718cf9cc3d20feb58a2aaeb029f71daad66fb63aa700ab4370919a6bbf14695ea22b42b02a52c88d9d701fdb8da700944f8b535d92b51
SSDEEP

12288:KIR5x+u6RfbWYCrt/22puGGh6abmMbvZwPO5ICnCP1L8idw0sDn2GVOthPc4Ti/+:I3WYatucdv0CP1I4ENOthPZT8Y1OQt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2468	2940	comprobante de pago swift.exe	30
PID 2940 wrote to memory of 2468	2940	comprobante de pago swift.exe	30
PID 2940 wrote to memory of 2468	2940	comprobante de pago swift.exe	30

C:\Users\Admin\AppData\Local\Temp\comprobante de pago swift.exe
"C:\Users\Admin\AppData\Local\Temp\comprobante de pago swift.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2940 -s 28
  2⤵
  PID:2468