34cef105cd8ee43da90df59fb3e7c0e257330240eea2faa4d37893b8e0d13ba5 | Triage

Resubmissions

30/04/2024, 15:51

240430-tamp6aad4v 10

30/04/2024, 15:48

240430-s8w6taac8v 1

Analysis

max time kernel
142s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 15:51

Sharing

Report Analysis Logs

General

Target

5 NOTIFICACION DEMANDA/Register.dll
Size

1.0MB
MD5

dd001e7a2f751f6c9e8c40e23307d102
SHA1

22fdeab3d891334e2e27d970b3a5680d45cb3371
SHA256

e2b66236119bfea1571f423a721b1c4495b2363a0af83b8ec2ea728b4fdd7d7a
SHA512

ee9591e952028aab264ed6fa51369bb5c8d7aee4eaf735fd2f78b4559e2d07791d4d9777478d93be9de8952fa70105d9c431a48d380eebe637138fa188d7aae7
SSDEEP

24576:a0RdvjwJ4ZCWQufs54Quz27j7BS2Nv+4BT8+uCI:bDhTzAj7pXT3S

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 3340	3844	rundll32.exe	84
PID 3844 wrote to memory of 3340	3844	rundll32.exe	84
PID 3844 wrote to memory of 3340	3844	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5 NOTIFICACION DEMANDA\Register.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5 NOTIFICACION DEMANDA\Register.dll",#1
  2⤵
  PID:3340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads