d2dd89534869bb9d806c255437154a5ad7e26e67050dbcb73df4e7d2382b9db4

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 22:23

Target

DEMANDA JUDICIAL ESPECIAL 13252548/msvcp100.dll
Size

593KB
MD5

4f096d96285e06cd51aef7d2d3de04da
SHA1

c90ef0eb5b1a0b1b85ad6792291747fb6307dcdb
SHA256

5bb420fbe28315f2117376052bb8488ce84a3398dda65005b8ae1f792017e9a8
SHA512

80f558c50a71ad9c4930b3838b481e4fb453c38d57c91f7f70c1f86e4043b9a4fbcec27d7c025285504cbf3bde7c50b4770f18121d7818ac58e2ee9c2071f97c
SSDEEP

12288:uoBFUsQ1H5FH3YUTd/dfePA7XrNvEKZm+aWodEEGblH6t2:LFUsQ1H5FHdggrNvEKZm+aWodEEIH6t2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 276 wrote to memory of 1724	276	rundll32.exe	WerFault.exe
PID 276 wrote to memory of 1724	276	rundll32.exe	WerFault.exe
PID 276 wrote to memory of 1724	276	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DEMANDA JUDICIAL ESPECIAL 13252548\msvcp100.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 276 -s 80
2⤵
PID:1724