Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 01:28
Static task
static1
Behavioral task
behavioral1
Sample
-NOTIFICACIÓN JUDICIAL-DEMANDA DAÑOS Y PERJUICIO/003 PROCESO JUDICIAL.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
-NOTIFICACIÓN JUDICIAL-DEMANDA DAÑOS Y PERJUICIO/003 PROCESO JUDICIAL.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
-NOTIFICACIÓN JUDICIAL-DEMANDA DAÑOS Y PERJUICIO/ProductStatistics3.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
-NOTIFICACIÓN JUDICIAL-DEMANDA DAÑOS Y PERJUICIO/ProductStatistics3.dll
Resource
win10v2004-20240226-en
General
-
Target
-NOTIFICACIÓN JUDICIAL-DEMANDA DAÑOS Y PERJUICIO/ProductStatistics3.dll
-
Size
1.1MB
-
MD5
7921963b2109ca7e449512fdcf42e527
-
SHA1
7e4d33b4f6b8899542c2d3233bdb1bff1018ac92
-
SHA256
626b7b8c6a580ed869eb113ed6897099251471586c4f34f0647946819fc3f75b
-
SHA512
7194e2b909cd0fecf3986f38fe19312bb79b5dc6fa8639a530d5ca78679aacd372aeccc3b098ef3e0f89580cbe22743209c78d084b0a79ad32c131d20c357f72
-
SSDEEP
24576:WkD9IKosUoI8xDN7J3Uvro8h+hwO3IMd7EY86:R7j80qO4Md7g6
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 5040 552 WerFault.exe 88 368 552 WerFault.exe 88 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2332 wrote to memory of 552 2332 rundll32.exe 88 PID 2332 wrote to memory of 552 2332 rundll32.exe 88 PID 2332 wrote to memory of 552 2332 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\-NOTIFICACIÓN JUDICIAL-DEMANDA DAÑOS Y PERJUICIO\ProductStatistics3.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\-NOTIFICACIÓN JUDICIAL-DEMANDA DAÑOS Y PERJUICIO\ProductStatistics3.dll",#12⤵PID:552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 6403⤵
- Program crash
PID:5040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 6403⤵
- Program crash
PID:368
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 552 -ip 5521⤵PID:1320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 552 -ip 5521⤵PID:1392