27ebf2af9882393ec6c1ebd17a32c607b08337d419ad93692b9cb44ba54c47cc

Analysis

max time kernel
300s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20240412-es
resource tags

arch:x64arch:x86image:win10v2004-20240412-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
23-04-2024 03:27

Target

Notificacion Judicial 854651/gmodule-2.0.dll
Size

24KB
MD5

b0a421b1534f3194132ec091780472d8
SHA1

699b1edc2cb19a48999a52a62a57ffc0f48f1a78
SHA256

2d6bc34b38bc0abf0c5e2f40e2513b4df47af57848534e011a76d4e974ad958b
SHA512

ba74654843c5b0f94dfefbed81cbee4c5f360193ef8ea92836c712fbeada39fa8179a51f0849f6c4be23add1ced08f5e25f873c4b0e7533ae647fa2b19b83f98
SSDEEP

384:3yCTiyTIlmltk6yvfEPLS9OeGYDVEiAhbJM8bDmnYPLm6HEGJqUHeMN6B:3yCWyTIlmltTQO87hB3QX/mz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3272	1788	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1788	4572	rundll32.exe	83
PID 4572 wrote to memory of 1788	4572	rundll32.exe	83
PID 4572 wrote to memory of 1788	4572	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Notificacion Judicial 854651\gmodule-2.0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Notificacion Judicial 854651\gmodule-2.0.dll",#1
  2⤵
  PID:1788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 228
    3⤵
    - Program crash
    PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1788 -ip 1788
1⤵
PID:3232

memory/1788-0-0x0000000000750000-0x0000000000764000-memory.dmp

Filesize
80KB

Download