c0747c10be35b8c1072a360c7759228b17f35d2ec890154020c716d572b00fbd | Triage

Analysis

max time kernel
358s
max time network
363s
platform
windows7_x64
resource
win7-20240221-es
resource tags

arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
submitted
26/04/2024, 22:54

Sharing

Report Analysis Logs

General

Target

CITACION DEMANDA/AsIO.dll
Size

120KB
MD5

24d5874d5403d369ca66a53f4d7c818f
SHA1

e171a2b0f5189a0f7374ae99e02b1138066d5147
SHA256

406f0c9c379ac28f1135d8c2aea49d5105782631cbf5259800e19b93813412c4
SHA512

bdc845f04e300e9ee5db7cd001e7d7dbd8485d94c957d71a9740e98a66ecaa5089257ffb3e25d399763a88b2e20b339505b1282c254dc0d9e44b71fcf7adbc88
SSDEEP

3072:A1CK0llptaTHfPwr5pm6Qi0ZqaPkyP87vuL:AQbllaborzQtTYvy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2912	2892	rundll32.exe	28
PID 2892 wrote to memory of 2912	2892	rundll32.exe	28
PID 2892 wrote to memory of 2912	2892	rundll32.exe	28
PID 2892 wrote to memory of 2912	2892	rundll32.exe	28
PID 2892 wrote to memory of 2912	2892	rundll32.exe	28
PID 2892 wrote to memory of 2912	2892	rundll32.exe	28
PID 2892 wrote to memory of 2912	2892	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\AsIO.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\AsIO.dll",#1
  2⤵
  PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads