34cef105cd8ee43da90df59fb3e7c0e257330240eea2faa4d37893b8e0d13ba5

Resubmissions

30/04/2024, 15:51

30/04/2024, 15:48

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 15:51

Target

5 NOTIFICACION DEMANDA/vcl120.dll
Size

1.9MB
MD5

c594d746ff6c99d140b5e8da97f12fd4
SHA1

f21742707c5f3fee776f98641f36bd755e24a7b0
SHA256

572edb7d630e9b03f93bd15135d2ca360176c1232051293663ec5b75c2428aec
SHA512

33b9902b2cf1154d850779cd012c0285882e158b9d1422c54ea9400ca348686773b6bacb760171060d1a0e620f8ff4a26ecd889dea3c454e8fc5fa59b173832b
SSDEEP

24576:j2gekcIlYas4GaAKBTZTkZbJ7YBRSjr2WLPcgjzTGlyz6F:jRvzfZT3XSmqcOTGc+F

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3980	3268	rundll32.exe	92
PID 3268 wrote to memory of 3980	3268	rundll32.exe	92
PID 3268 wrote to memory of 3980	3268	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5 NOTIFICACION DEMANDA\vcl120.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5 NOTIFICACION DEMANDA\vcl120.dll",#1
  2⤵
  PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3648 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4576