59c4eac59865fae0ef3c43a6126784583a168b57e73a8743ef5dd063dfd86d19

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-10-2024 16:49

Target

DESCARGA NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO RADICADO 4534135431 00 654165135/vcruntime140_1.dll
Size

37KB
MD5

75e78e4bf561031d39f86143753400ff
SHA1

324c2a99e39f8992459495182677e91656a05206
SHA256

1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
SHA512

ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756
SSDEEP

768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2920 wrote to memory of 1600	2920	rundll32.exe	WerFault.exe
PID 2920 wrote to memory of 1600	2920	rundll32.exe	WerFault.exe
PID 2920 wrote to memory of 1600	2920	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DESCARGA NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO RADICADO 4534135431 00 654165135\vcruntime140_1.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2920 -s 80
2⤵
PID:1600