59c4eac59865fae0ef3c43a6126784583a168b57e73a8743ef5dd063dfd86d19

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23/10/2024, 16:49

Target
DESCARGA NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO RADICADO 4534135431 00 654165135/vcruntime140_1.dll
Size 37KB
Sample241023-vb6ebszhmf
SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
MD5 75e78e4bf561031d39f86143753400ff
SHA1 324c2a99e39f8992459495182677e91656a05206
SHA512 ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756
SSDEEP 768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1600	2920	rundll32.exe	28
PID 2920 wrote to memory of 1600	2920	rundll32.exe	28
PID 2920 wrote to memory of 1600	2920	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DESCARGA NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO RADICADO 4534135431 00 654165135\vcruntime140_1.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2920 -s 80
  2⤵
  PID:1600