Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2024 02:28

General

  • Target

    Notificacion especial 1212448/Aviso Especial juridico/madexcept_.dll

  • Size

    436KB

  • MD5

    98e59596edd9b888d906c5409e515803

  • SHA1

    b79d73967a2df21d00740bc77ccebda061b44ab6

  • SHA256

    a6ca13af74a64e4ab5ebb2d12b757cecf1a683cb9cd0ae7906db1b4b2c8a90c0

  • SHA512

    ba617227849d2eb3285395e2d1babfe01902be143144be895011f0389f1860d0d7f08c6bbc4d461384eba270f866cce3351f52af1dc9ef9719c677619de79e42

  • SSDEEP

    6144:1lAz49EKhEV30F8sl88nTjQ4Q50gEcW/jd+o72niVUNMa4Yn2g:1lG4ut30F8slzYlQcW/jd++2nJ6u2g

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Notificacion especial 1212448\Aviso Especial juridico\madexcept_.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Notificacion especial 1212448\Aviso Especial juridico\madexcept_.dll",#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2764-0-0x0000000059800000-0x000000005986E000-memory.dmp

    Filesize

    440KB

  • memory/2764-1-0x0000000050000000-0x0000000050116000-memory.dmp

    Filesize

    1.1MB

  • memory/2764-2-0x0000000057000000-0x000000005703F000-memory.dmp

    Filesize

    252KB

  • memory/2764-4-0x0000000057800000-0x0000000057812000-memory.dmp

    Filesize

    72KB

  • memory/2764-3-0x0000000050120000-0x000000005030D000-memory.dmp

    Filesize

    1.9MB