Resubmissions
30/07/2024, 22:59
240730-2ynw5ayajh1030/07/2024, 22:56
240730-2wvlwsxhma1030/07/2024, 22:49
240730-2rrpfatbrk10Analysis
- max time kernel
94s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240730-en - resource tags
- submitted
30/07/2024, 22:49
General
- Target 05 CITACION DEMANDA EN SU CONTRA - JUZGADO PENAL 01 DEL CIRCUITO RAMA JUDICIAL ESPECIALIZADO/maddisAsm_.dll
- Size 63KB
- Sample240730-2rrpfatbrk
- SHA256 475f7cdffd8ed4d6f52bd98ae2bb684f1c923a1be2a692757a9af788a39b1d87
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\05 CITACION DEMANDA EN SU CONTRA - JUZGADO PENAL 01 DEL CIRCUITO RAMA JUDICIAL ESPECIALIZADO\maddisAsm_.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\05 CITACION DEMANDA EN SU CONTRA - JUZGADO PENAL 01 DEL CIRCUITO RAMA JUDICIAL ESPECIALIZADO\maddisAsm_.dll",#12⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4888-0-0x0000000057800000-0x0000000057812000-memory.dmp
memory/4888-1-0x0000000050000000-0x0000000050116000-memory.dmp
memory/4888-3-0x0000000050120000-0x000000005030D000-memory.dmp
memory/4888-2-0x0000000057000000-0x000000005703F000-memory.dmp