c0747c10be35b8c1072a360c7759228b17f35d2ec890154020c716d572b00fbd | Triage

Analysis

max time kernel
502s
max time network
514s
platform
windows10-2004_x64
resource
win10v2004-20240419-es
resource tags

arch:x64arch:x86image:win10v2004-20240419-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
26/04/2024, 22:54

Sharing

Report Analysis Logs

General

Target

CITACION DEMANDA/AsIO.dll
Size

120KB
MD5

24d5874d5403d369ca66a53f4d7c818f
SHA1

e171a2b0f5189a0f7374ae99e02b1138066d5147
SHA256

406f0c9c379ac28f1135d8c2aea49d5105782631cbf5259800e19b93813412c4
SHA512

bdc845f04e300e9ee5db7cd001e7d7dbd8485d94c957d71a9740e98a66ecaa5089257ffb3e25d399763a88b2e20b339505b1282c254dc0d9e44b71fcf7adbc88
SSDEEP

3072:A1CK0llptaTHfPwr5pm6Qi0ZqaPkyP87vuL:AQbllaborzQtTYvy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3424	3548	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3548	4476	rundll32.exe	83
PID 4476 wrote to memory of 3548	4476	rundll32.exe	83
PID 4476 wrote to memory of 3548	4476	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\AsIO.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\AsIO.dll",#1
  2⤵
  PID:3548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 568
    3⤵
    - Program crash
    PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3548 -ip 3548
1⤵
PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads