f7b398d27c0e269bf09dfefa9ee52559e953b1030ed432361c4e7d0a167b4438

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 01:43

Target
001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL/gobject-2.0.dll
Size 281KB
Sample240422-b5j9eaeb3v
SHA256 78dd76027e10c17824978db821777fcaa58d7cd5d5eb9d80d6ee817e26b18ab8
MD5 24a7a712160abc3f23f7410b18de85b8
SHA1 a01c3e116b6496c9feaa2951f6f6633bb403c3a1
SHA512 d1f14a7bd44e1fc9bfc61f0b751ee6e0677322807ce5621206eeef898bab6c71ef1464962b20dc50f706084e53281a0d4b6d9142c6c1170a1e0a5fe4b12171df
SSDEEP 3072:2OoLt6w1bALJPPcGPXGHv5aHi9IdzMxtcZJPn4/3KLW6QgMFhQZhXMGSQQ8:qLt6w1byk+2H/c8YPn4SLWQMFhQZOQj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28
PID 1684 wrote to memory of 1964	1684	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL\gobject-2.0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\001-NOTIFICACION JUDICIAL AUTO DE IMPUTACION POR INCUMPLIMIENTO FISCAL\gobject-2.0.dll",#1
  2⤵
  PID:1964

memory/1964-0-0x0000000001F80000-0x0000000002094000-memory.dmp

Download

memory/1964-2-0x0000000000020000-0x000000000002E000-memory.dmp

Download