70e66269fdda2a652f36ab5f210fca880072caeb0351511526f830bea0ea4da7

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2023, 20:02

Target
PROCESO JURIDICO DOC/http_dll.dll
Size 883KB
Sample231116-yscecsgd6v
SHA256 54fc9f4699d8fb59ce1635df5aaa2994b5d924d7b4d7626e1b5d9a406bef899d
MD5 41afa1c6d2d553fb524ba32b1a5c8e89
SHA1 47dee023914c7fd9ecc7d130d3d0d92842cb7305
SHA512 fdf016f10751df0528e15213ba5a2c3c3e9ffc482db819ae56d7245a3925b7fe778c92fb8ef85cbd68e5a1bacf274cf4d3d4b86a610c2549ce52c1471bbb9bdd
SSDEEP 24576:Wzq6uStsPOf+2nVWeqnm5dVjPiV95qyq15:Oq/GbVWCPXyq15
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 1280	4276	rundll32.exe	86
PID 4276 wrote to memory of 1280	4276	rundll32.exe	86
PID 4276 wrote to memory of 1280	4276	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\PROCESO JURIDICO DOC\http_dll.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\PROCESO JURIDICO DOC\http_dll.dll",#1
  2⤵
  PID:1280