Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    28-10-2024 19:49

General

  • Target

    282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024/rtl120.dll

  • Size

    1.1MB

  • MD5

    d1a623ea5ab8c3531be70f0ab922c63f

  • SHA1

    f4bede641cd2c98a3bbf764e19cf89ab194d4ee3

  • SHA256

    9bc0d017fa727210f0bd2bf8f3f881e448d72b963c957385349060db5062ec19

  • SHA512

    1b038bfc69616fdf57414081340f5bafee213a939337f1bcb1e362631ff45fcceb3326037523b484c9da7e59e971ae1d97a4385874c783febea6853b9175379f

  • SSDEEP

    24576:Kbhp5FWbA1msvIRzM7Rk5JZzSQ4+Is2FjJL0lboo:72VJglboo

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024\rtl120.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\282024-ENVIO COPIA DE LA NOTIFICACION ELETRONICA-282024\rtl120.dll",#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads