b788a361bc35172e96fcbc836873a9079dba5ca3d31f2767331dd821b4cb5eee

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2024, 07:14

Target

NOTIFICACION DEMANDA -JUZGADO 01 PENAL DEL CIRCUITO/madHcNet32.dll
Size

921KB
MD5

2ba4099eb6fbac4eaae2d6dfe71b4e18
SHA1

fb6c32e1589cfa0121e15606932671f27ee963be
SHA256

8bd3edbf027972636bdb4cbb46037f0be98ca233e19b003e860af0bd7526a0ac
SHA512

953fe3a3328b871aac6ba9ce1242efa8e9d567f50eb22b3afee549ec9a83192b61ee479ddae44a5a63ee6594e8a73afda521f538f2e5eb750c15a00541864241
SSDEEP

24576:DlUbWq3/gquYUJ4Vgv0eUnDaE0eyxfcT9D:ZUR4quYUJ4VgceXE0ZxfAh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 2472	3592	rundll32.exe	84
PID 3592 wrote to memory of 2472	3592	rundll32.exe	84
PID 3592 wrote to memory of 2472	3592	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION DEMANDA -JUZGADO 01 PENAL DEL CIRCUITO\madHcNet32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION DEMANDA -JUZGADO 01 PENAL DEL CIRCUITO\madHcNet32.dll",#1
  2⤵
  PID:2472

memory/2472-0-0x000000004A600000-0x000000004A6EC000-memory.dmp

Filesize
944KB

Download