27ebf2af9882393ec6c1ebd17a32c607b08337d419ad93692b9cb44ba54c47cc

Analysis

max time kernel
299s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20240412-es
resource tags

arch:x64arch:x86image:win10v2004-20240412-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
23-04-2024 03:27

Target

Notificacion Judicial 854651/intl.dll
Size

87KB
MD5

d1a21e38593fddba8e51ed6bf7acf404
SHA1

759f16325f0920933ac977909b7fe261e0e129e6
SHA256

6a64c9cb0904ed48ce0d5cda137fcfd6dd463d84681436ca647b195aa2038a7e
SHA512

3f4390603cd68d949eb938c1599503fb1cbb1b8250638e0985fad2f40f08d5e45ea4a8c149e44a50c6aa9077054387c48f71b53bf06b713ca1e73a3d5a6a6c2e
SSDEEP

1536:R3P7SvYgvNf+ZSz6wHFK1XErzMfb2z/oMJtEZMGG3:RjGYgvNf+ZSzJlK1XErzMfb2z/oMbEOV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5780	3068	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3068	3668	rundll32.exe	84
PID 3668 wrote to memory of 3068	3668	rundll32.exe	84
PID 3668 wrote to memory of 3068	3668	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Notificacion Judicial 854651\intl.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Notificacion Judicial 854651\intl.dll",#1
  2⤵
  PID:3068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 612
    3⤵
    - Program crash
    PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3068 -ip 3068
1⤵
PID:4056