c0747c10be35b8c1072a360c7759228b17f35d2ec890154020c716d572b00fbd

Analysis

max time kernel
357s
max time network
358s
platform
windows7_x64
resource
win7-20240221-es
resource tags

arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
submitted
26/04/2024, 22:54

Target

CITACION DEMANDA/ASUS_WMI.dll
Size

224KB
MD5

3f109a02c8d642e8003a1188df40d861
SHA1

f723f38471b8872443aa9177eef12a96c02cc84a
SHA256

6523b44da6fa7078c7795b7705498e487b0625e28e15aec2d270c6e4a909b5a5
SHA512

023696a52d48c465ab62e3ee754b445093b8a0ed0a232b430ce1f0db3dae382c9e1fba210c2b04d1018cc29bfb69c546976912f3939a76e98bcb792ae57af0da
SSDEEP

3072:Y4WuqFgPmBNRP8hXzGXPkW6ZZW8egH1/jQoAg0FubAxZ+051gh9b6q4TQWdO8g:Y9t2nhQ2ZW8ecAOAZCqQWY8g

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1688	2424	rundll32.exe	28
PID 2424 wrote to memory of 1688	2424	rundll32.exe	28
PID 2424 wrote to memory of 1688	2424	rundll32.exe	28
PID 2424 wrote to memory of 1688	2424	rundll32.exe	28
PID 2424 wrote to memory of 1688	2424	rundll32.exe	28
PID 2424 wrote to memory of 1688	2424	rundll32.exe	28
PID 2424 wrote to memory of 1688	2424	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\ASUS_WMI.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\ASUS_WMI.dll",#1
  2⤵
  PID:1688