3413c79e267f2906768a05abceb441e0503d346134b8731a086df0db1be84d90

Analysis

max time kernel
113s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 01:11

Target

NOTIFICACION_JUDICIAL/NOTIFICACION DEMANDA/gmodule-2.0.dll
Size

24KB
MD5

b0a421b1534f3194132ec091780472d8
SHA1

699b1edc2cb19a48999a52a62a57ffc0f48f1a78
SHA256

2d6bc34b38bc0abf0c5e2f40e2513b4df47af57848534e011a76d4e974ad958b
SHA512

ba74654843c5b0f94dfefbed81cbee4c5f360193ef8ea92836c712fbeada39fa8179a51f0849f6c4be23add1ced08f5e25f873c4b0e7533ae647fa2b19b83f98
SSDEEP

384:3yCTiyTIlmltk6yvfEPLS9OeGYDVEiAhbJM8bDmnYPLm6HEGJqUHeMN6B:3yCWyTIlmltTQO87hB3QX/mz

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3952 1752 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3952	1752	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2724 wrote to memory of 1752	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 1752	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 1752	2724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\gmodule-2.0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_JUDICIAL\NOTIFICACION DEMANDA\gmodule-2.0.dll",#1
2⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 228
3⤵
- Program crash
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1752 -ip 1752
1⤵
PID:2480

memory/1752-0-0x0000000000690000-0x00000000006A4000-memory.dmp

Filesize
80KB

Download