0cae7d4a147feddc2b5297c6e95311171d494ee0c173c05354494cbcc31215cf

Analysis

max time kernel
133s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-07-2024 18:42

Target

NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-/madHcNet32.dll
Size

921KB
MD5

2ba4099eb6fbac4eaae2d6dfe71b4e18
SHA1

fb6c32e1589cfa0121e15606932671f27ee963be
SHA256

8bd3edbf027972636bdb4cbb46037f0be98ca233e19b003e860af0bd7526a0ac
SHA512

953fe3a3328b871aac6ba9ce1242efa8e9d567f50eb22b3afee549ec9a83192b61ee479ddae44a5a63ee6594e8a73afda521f538f2e5eb750c15a00541864241
SSDEEP

24576:DlUbWq3/gquYUJ4Vgv0eUnDaE0eyxfcT9D:ZUR4quYUJ4VgceXE0ZxfAh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4676	4512	rundll32.exe	73
PID 4512 wrote to memory of 4676	4512	rundll32.exe	73
PID 4512 wrote to memory of 4676	4512	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-\madHcNet32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACION DEMANDA EN SU CONTRA -JUZGADO 03 CIVIL DEL CIRCUITO RAMA JUDICIAL-\madHcNet32.dll",#1
  2⤵
  PID:4676

memory/4676-0-0x000000004A600000-0x000000004A6EC000-memory.dmp

Filesize
944KB

Download