3413c79e267f2906768a05abceb441e0503d346134b8731a086df0db1be84d90

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 01:11

Target

NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/glib-2.0.dll
Size

1.0MB
MD5

56d98e0fece16c12a176c42dce671436
SHA1

daefaac6defa8776b47884dfe65fddf28d29018d
SHA256

0e44fe39011447190766bb28495e9f293acac4274aa561f7a0cf41d62a294aa8
SHA512

7fe2da1b5b73e8a9bf4e43977e8c88501b63f8f39e585716a4afddc9b78e3d9bb19733505968a5233ae1691a1980cb9052e0e2c58d9bd69599c92d2f39cdbe9d
SSDEEP

24576:PekMj5RU/KFHOTHRMQMa62jcS/KPDIj5d0HlGQrVmPQk:PekMjoKsRMQ+S/iDIj5d0FLVmYk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3992 2664 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3992	2664	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3060 wrote to memory of 2664	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2664	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2664	3060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\glib-2.0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\glib-2.0.dll",#1
2⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 204
3⤵
- Program crash
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2664 -ip 2664
1⤵
PID:1948

memory/2664-0-0x0000000000090000-0x00000000000A4000-memory.dmp

Filesize
80KB

Download