Overview
overview
10Static
static
101 PROCESO...AL.exe
windows7-x64
1001 PROCESO...AL.exe
windows10-2004-x64
1001 PROCESO...c_.dll
windows7-x64
101 PROCESO...c_.dll
windows10-2004-x64
101 PROCESO...m_.dll
windows7-x64
101 PROCESO...m_.dll
windows10-2004-x64
101 PROCESO...t_.dll
windows7-x64
101 PROCESO...t_.dll
windows10-2004-x64
101 PROCESO...20.dll
windows7-x64
101 PROCESO...20.dll
windows10-2004-x64
101 PROCESO...20.dll
windows7-x64
101 PROCESO...20.dll
windows10-2004-x64
101 PROCESO...20.dll
windows7-x64
301 PROCESO...20.dll
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 09:07
Static task
static1
Behavioral task
behavioral1
Sample
01 PROCESO JUDICIAL EN SU CONTRA/01 PROCESO JUDICIAL.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
01 PROCESO JUDICIAL EN SU CONTRA/01 PROCESO JUDICIAL.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
01 PROCESO JUDICIAL EN SU CONTRA/madbasic_.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
01 PROCESO JUDICIAL EN SU CONTRA/madbasic_.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
01 PROCESO JUDICIAL EN SU CONTRA/maddisAsm_.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
01 PROCESO JUDICIAL EN SU CONTRA/maddisAsm_.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
01 PROCESO JUDICIAL EN SU CONTRA/madexcept_.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
01 PROCESO JUDICIAL EN SU CONTRA/madexcept_.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
01 PROCESO JUDICIAL EN SU CONTRA/rtl120.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
01 PROCESO JUDICIAL EN SU CONTRA/rtl120.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
01 PROCESO JUDICIAL EN SU CONTRA/vcl120.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
01 PROCESO JUDICIAL EN SU CONTRA/vcl120.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
01 PROCESO JUDICIAL EN SU CONTRA/vclx120.dll
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
01 PROCESO JUDICIAL EN SU CONTRA/vclx120.dll
Resource
win10v2004-20240426-en
General
-
Target
01 PROCESO JUDICIAL EN SU CONTRA/vclx120.dll
-
Size
222KB
-
MD5
3cb8f7606940c9b51c45ebaeb84af728
-
SHA1
7f33a8b5f8f7210bd93b330c5e27a1e70b22f57b
-
SHA256
2feec33d1e3f3d69c717f4528b8f7f5c030caae6fb37c2100cb0b5341367d053
-
SHA512
7559cdf6c8dbea052242f3b8129979f7d2d283f84040f1d68ae10438548072715a56a5af88b8562aeea7143194e7c5bddac3fdb01ded411a0b1cac9f0c6eef3f
-
SSDEEP
3072:K4af8kXL6nX0YXjvkWQ5vYhbNkWPFOEJ8YZbjeTl0Y25zFgYBzRKy6sB65avEtAA:baf8kLWL7Xov8bNxdOmrfgYmHA6h
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1228 2036 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1764 wrote to memory of 2036 1764 rundll32.exe rundll32.exe PID 1764 wrote to memory of 2036 1764 rundll32.exe rundll32.exe PID 1764 wrote to memory of 2036 1764 rundll32.exe rundll32.exe PID 1764 wrote to memory of 2036 1764 rundll32.exe rundll32.exe PID 1764 wrote to memory of 2036 1764 rundll32.exe rundll32.exe PID 1764 wrote to memory of 2036 1764 rundll32.exe rundll32.exe PID 1764 wrote to memory of 2036 1764 rundll32.exe rundll32.exe PID 2036 wrote to memory of 1228 2036 rundll32.exe WerFault.exe PID 2036 wrote to memory of 1228 2036 rundll32.exe WerFault.exe PID 2036 wrote to memory of 1228 2036 rundll32.exe WerFault.exe PID 2036 wrote to memory of 1228 2036 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\01 PROCESO JUDICIAL EN SU CONTRA\vclx120.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\01 PROCESO JUDICIAL EN SU CONTRA\vclx120.dll",#12⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 2683⤵
- Program crash
PID:1228