Analysis

  • max time kernel
    300s
  • max time network
    203s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-es
  • resource tags

    arch:x64arch:x86image:win11-20241007-eslocale:es-esos:windows11-21h2-x64systemwindows
  • submitted
    24-10-2024 16:25

General

  • Target

    00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA/msvcr90.dll

  • Size

    638KB

  • MD5

    11d49148a302de4104ded6a92b78b0ed

  • SHA1

    fd58a091b39ed52611ade20a782ef58ac33012af

  • SHA256

    ceb0947d898bc2a55a50f092f5ed3f7be64ac1cd4661022eefd3edd4029213b0

  • SHA512

    fdc43b3ee38f7beb2375c953a29db8bcf66b73b78ccc04b147e26108f3b650c0a431b276853bb8e08167d34a8cc9c6b7918daef9ebc0a4833b1534c5afac75e4

  • SSDEEP

    12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\msvcr90.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6004
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\00898-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA\msvcr90.dll",#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:6100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads