68a3b0aeb897a522ab21ba4fb8d1d9b7a59e16a0799bc36e77183201cad96699

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-10-2024 23:00

Target

DESCARGAR NOTIFICACIÓN DE SENTENCIA Nro 12893 RAMA JUDICIAL DEL PODER PÚBLICO/vcruntime140_1.dll
Size

37KB
MD5

75e78e4bf561031d39f86143753400ff
SHA1

324c2a99e39f8992459495182677e91656a05206
SHA256

1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
SHA512

ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756
SSDEEP

768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2128 wrote to memory of 2732	2128	rundll32.exe	WerFault.exe
PID 2128 wrote to memory of 2732	2128	rundll32.exe	WerFault.exe
PID 2128 wrote to memory of 2732	2128	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DESCARGAR NOTIFICACIÓN DE SENTENCIA Nro 12893 RAMA JUDICIAL DEL PODER PÚBLICO\vcruntime140_1.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2128 -s 84
2⤵
PID:2732