534d1e3d7e1b3da44c4a24e67d2467ed56ac5644d8f92288b19ac4be7853c5f3

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 09:32

Target

001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/gobject-2.0.dll
Size

281KB
MD5

24a7a712160abc3f23f7410b18de85b8
SHA1

a01c3e116b6496c9feaa2951f6f6633bb403c3a1
SHA256

78dd76027e10c17824978db821777fcaa58d7cd5d5eb9d80d6ee817e26b18ab8
SHA512

d1f14a7bd44e1fc9bfc61f0b751ee6e0677322807ce5621206eeef898bab6c71ef1464962b20dc50f706084e53281a0d4b6d9142c6c1170a1e0a5fe4b12171df
SSDEEP

3072:2OoLt6w1bALJPPcGPXGHv5aHi9IdzMxtcZJPn4/3KLW6QgMFhQZhXMGSQQ8:qLt6w1byk+2H/c8YPn4SLWQMFhQZOQj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2252 4256 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2252	4256	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5088 wrote to memory of 4256	5088	rundll32.exe	rundll32.exe
PID 5088 wrote to memory of 4256	5088	rundll32.exe	rundll32.exe
PID 5088 wrote to memory of 4256	5088	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL\gobject-2.0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5088

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL\gobject-2.0.dll",#1
2⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 212
3⤵
- Program crash
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4256 -ip 4256
1⤵
PID:444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:3576

memory/4256-0-0x0000000000530000-0x0000000000544000-memory.dmp

Filesize
80KB

Download