3413c79e267f2906768a05abceb441e0503d346134b8731a086df0db1be84d90

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 01:11

Target

NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/vmtools.dll
Size

617KB
MD5

65c3c2a741838474a592679cda346753
SHA1

043d80766dd4e49d8dca6ac72b04e09b5491fdc9
SHA256

4e5f2c54d9ecfe48999edfcce0de038948f8b20ff68e299c55d9a2d6f65713e8
SHA512

e5d8b308586ffa914f46b6766217eb12ad759853d25108db06170b870d0e8947e2befabc2843f76cb864b0f0135a8f2163b7c93fe644b293789919d1d07c4079
SSDEEP

12288:uxox5+Qg/YYhflIuPj6sya8/TfOMCEB/15/Cyz0NSwsIEmotaAJW:uCxg5/YYhfmXOdQ15/CyYNSXIE1tJW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5108 3100 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5108	3100	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4292 wrote to memory of 3100	4292	rundll32.exe	rundll32.exe
PID 4292 wrote to memory of 3100	4292	rundll32.exe	rundll32.exe
PID 4292 wrote to memory of 3100	4292	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\vmtools.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\vmtools.dll",#1
2⤵
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 200
3⤵
- Program crash
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3100 -ip 3100
1⤵
PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:1444

memory/3100-0-0x0000000000660000-0x0000000000674000-memory.dmp

Filesize
80KB

Download