2d2b848aa86e57e02638e4e9beba831303f802225b95d769eaf198fec28308f9

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 14:42

Target

01 PROCESO JUDICIAL EN SU CONTRA/libcrypto-1_1-x64.dll
Size

2.7MB
MD5

28dea3e780552eb5c53b3b9b1f556628
SHA1

55dccd5b30ce0363e8ebdfeb1cca38d1289748b8
SHA256

52415829d85c06df8724a3d3d00c98f12beabf5d6f3cbad919ec8000841a86e8
SHA512

19dfe5f71901e43ea34d257f693ae1a36433dbdbcd7c9440d9b0f9eea24de65c4a8fe332f7b88144e1a719a6ba791c2048b4dd3e5b1ed0fdd4c813603ad35112
SSDEEP

49152:KlOh5PuX2I9Rkf5gnQ7duzGuqFCtLQ2IqNPz38JQ41CPwDv3uFfJ:Q2Irkn2Iqt38C41CPwDv3uFfJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2916 wrote to memory of 2928	2916	rundll32.exe	WerFault.exe
PID 2916 wrote to memory of 2928	2916	rundll32.exe	WerFault.exe
PID 2916 wrote to memory of 2928	2916	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\01 PROCESO JUDICIAL EN SU CONTRA\libcrypto-1_1-x64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2916 -s 104
  2⤵
  PID:2928