f7b398d27c0e269bf09dfefa9ee52559e953b1030ed432361c4e7d0a167b4438

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 01:43

Target
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/glib-2.0.dll
Size 1.0MB
Sample240422-b5j9eaeb3v
SHA256 64144483049fed3406f23d7028388b687a8e4c4d822171b18a295f70ccf220e0
MD5 132b0e16e2add7808e17f113a7724aeb
SHA1 aa7e3e20b6eaa1c5db5b4a2ca060be71ba3ef8c1
SHA512 4d91e249ca8609d1ec13ad526532a1d6e6141a1828fce25ac0e7319c24dc354773a9e09a58ecd62f57035b39a225b5d77377749af2cf2be9da01b159879db39d
SSDEEP 24576:PekMj5RU/KFHOTHRMQMa62jcS/KPDIj5d0HlKQrVmPQk:PekMjoKsRMQ+S/iDIj5d0FPVmYk
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL\glib-2.0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL\glib-2.0.dll",#1
  2⤵
  PID:1128

memory/1128-0-0x00000000020D0000-0x00000000021E4000-memory.dmp

Download

memory/1128-2-0x0000000000900000-0x000000000090E000-memory.dmp

Download