f7b398d27c0e269bf09dfefa9ee52559e953b1030ed432361c4e7d0a167b4438

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 01:43

Target
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/gmodule-2.0.dll
Size 24KB
Sample240422-b5j9eaeb3v
SHA256 2d6bc34b38bc0abf0c5e2f40e2513b4df47af57848534e011a76d4e974ad958b
MD5 b0a421b1534f3194132ec091780472d8
SHA1 699b1edc2cb19a48999a52a62a57ffc0f48f1a78
SHA512 ba74654843c5b0f94dfefbed81cbee4c5f360193ef8ea92836c712fbeada39fa8179a51f0849f6c4be23add1ced08f5e25f873c4b0e7533ae647fa2b19b83f98
SSDEEP 384:3yCTiyTIlmltk6yvfEPLS9OeGYDVEiAhbJM8bDmnYPLm6HEGJqUHeMN6B:3yCWyTIlmltTQO87hB3QX/mz
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1312	2696	rundll32.exe	28
PID 2696 wrote to memory of 1312	2696	rundll32.exe	28
PID 2696 wrote to memory of 1312	2696	rundll32.exe	28
PID 2696 wrote to memory of 1312	2696	rundll32.exe	28
PID 2696 wrote to memory of 1312	2696	rundll32.exe	28
PID 2696 wrote to memory of 1312	2696	rundll32.exe	28
PID 2696 wrote to memory of 1312	2696	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL\gmodule-2.0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL\gmodule-2.0.dll",#1
  2⤵
  PID:1312

memory/1312-0-0x0000000000890000-0x00000000009A4000-memory.dmp

Download

memory/1312-2-0x00000000002A0000-0x00000000002AE000-memory.dmp

Download