b068551efd76728e44f1bf22c106e84960536cdb5245d22860b84e92eab894d2

Analysis

max time kernel
139s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 11:31

Target

NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09/madHcNet32.dll
Size

921KB
MD5

2ba4099eb6fbac4eaae2d6dfe71b4e18
SHA1

fb6c32e1589cfa0121e15606932671f27ee963be
SHA256

8bd3edbf027972636bdb4cbb46037f0be98ca233e19b003e860af0bd7526a0ac
SHA512

953fe3a3328b871aac6ba9ce1242efa8e9d567f50eb22b3afee549ec9a83192b61ee479ddae44a5a63ee6594e8a73afda521f538f2e5eb750c15a00541864241
SSDEEP

24576:DlUbWq3/gquYUJ4Vgv0eUnDaE0eyxfcT9D:ZUR4quYUJ4VgceXE0ZxfAh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 4312	2408	rundll32.exe	86
PID 2408 wrote to memory of 4312	2408	rundll32.exe	86
PID 2408 wrote to memory of 4312	2408	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\madHcNet32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\madHcNet32.dll,#1
  2⤵
  PID:4312

memory/4312-0-0x000000004A600000-0x000000004A6EC000-memory.dmp

Filesize
944KB

Download