3413c79e267f2906768a05abceb441e0503d346134b8731a086df0db1be84d90

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 01:11

Target

NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gmodule-2.0.dll
Size

24KB
MD5

b0a421b1534f3194132ec091780472d8
SHA1

699b1edc2cb19a48999a52a62a57ffc0f48f1a78
SHA256

2d6bc34b38bc0abf0c5e2f40e2513b4df47af57848534e011a76d4e974ad958b
SHA512

ba74654843c5b0f94dfefbed81cbee4c5f360193ef8ea92836c712fbeada39fa8179a51f0849f6c4be23add1ced08f5e25f873c4b0e7533ae647fa2b19b83f98
SSDEEP

384:3yCTiyTIlmltk6yvfEPLS9OeGYDVEiAhbJM8bDmnYPLm6HEGJqUHeMN6B:3yCWyTIlmltTQO87hB3QX/mz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2184 wrote to memory of 2200	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2200	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2200	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2200	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2200	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2200	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2200	2184	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\gmodule-2.0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\gmodule-2.0.dll",#1
2⤵
PID:2200

memory/2200-0-0x0000000001FB0000-0x00000000020C4000-memory.dmp

Filesize
1.1MB

Download
memory/2200-2-0x00000000004F0000-0x00000000004FE000-memory.dmp

Filesize
56KB

Download