3413c79e267f2906768a05abceb441e0503d346134b8731a086df0db1be84d90

Analysis

max time kernel
135s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 01:11

Target

NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gthread-2.0.dll
Size

31KB
MD5

78cf6611f6928a64b03a57fe218c3cd4
SHA1

c3f167e719aa944af2e80941ac629d39cec22308
SHA256

dbaad965702b89c371462e735dd925c694eda8d8557b280f7264bba992c0e698
SHA512

5caf019a6b75ba0330b8d0b60d362201d4863c0f3d70d2a9c84b6dbea2027d09bc8a6433820f28a41d126c7aaa13dbe126b38dc5c6d14a67ddef402fed9d9b7c
SSDEEP

384:Uwu65o6vunfhlfz2bWTQHaFZDGXoM6m2SNqslNkMgq4w8w/nYPLm6HEGJqUHeMYD:Uwfo6vITf3QHanSYM6pUmMDQw/R2Kf

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4348 3984 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4348	3984	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1504 wrote to memory of 3984	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 3984	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 3984	1504	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\gthread-2.0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\gthread-2.0.dll",#1
2⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 208
3⤵
- Program crash
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3984 -ip 3984
1⤵
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:3684

memory/3984-0-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download