34cef105cd8ee43da90df59fb3e7c0e257330240eea2faa4d37893b8e0d13ba5 | Triage

Resubmissions

30-04-2024 15:51

240430-tamp6aad4v 10

30-04-2024 15:48

240430-s8w6taac8v 1

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 15:51

Sharing

Report Analysis Logs

General

Target

5 NOTIFICACION DEMANDA/Register.dll
Size

1.0MB
MD5

dd001e7a2f751f6c9e8c40e23307d102
SHA1

22fdeab3d891334e2e27d970b3a5680d45cb3371
SHA256

e2b66236119bfea1571f423a721b1c4495b2363a0af83b8ec2ea728b4fdd7d7a
SHA512

ee9591e952028aab264ed6fa51369bb5c8d7aee4eaf735fd2f78b4559e2d07791d4d9777478d93be9de8952fa70105d9c431a48d380eebe637138fa188d7aae7
SSDEEP

24576:a0RdvjwJ4ZCWQufs54Quz27j7BS2Nv+4BT8+uCI:bDhTzAj7pXT3S

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28
PID 2492 wrote to memory of 2488	2492	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5 NOTIFICACION DEMANDA\Register.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5 NOTIFICACION DEMANDA\Register.dll",#1
  2⤵
  PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2488-0-0x0000000000500000-0x000000000060F000-memory.dmp

Filesize
1.1MB

Download