Analysis

  • max time kernel
    137s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-10-2024 09:24

General

  • Target

    JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL/msvcr90.dll

  • Size

    638KB

  • MD5

    11d49148a302de4104ded6a92b78b0ed

  • SHA1

    fd58a091b39ed52611ade20a782ef58ac33012af

  • SHA256

    ceb0947d898bc2a55a50f092f5ed3f7be64ac1cd4661022eefd3edd4029213b0

  • SHA512

    fdc43b3ee38f7beb2375c953a29db8bcf66b73b78ccc04b147e26108f3b650c0a431b276853bb8e08167d34a8cc9c6b7918daef9ebc0a4833b1534c5afac75e4

  • SSDEEP

    12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL\msvcr90.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\JUZGADO PENAL DEL CIRCUITO - DEMANDA LABORAL\msvcr90.dll",#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads