Analysis
-
max time kernel
135s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2024 15:00
Static task
static1
Behavioral task
behavioral1
Sample
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/00030 NotificacionElectronica.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/00030 NotificacionElectronica.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/d3dx9_43.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/d3dx9_43.dll
Resource
win10v2004-20241007-en
General
-
Target
NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO/d3dx9_43.dll
-
Size
1.9MB
-
MD5
d87de826ca653d3bfe426337eadc0ee3
-
SHA1
6b2b89a1c20912ba848777722e49978443cc4b80
-
SHA256
6f0b9e1f52998e21db8b5a07305d93e699e9e766c0d04403f436e2551946701e
-
SHA512
06faa842aab3ffe9fab4fc84951bbb38d499a1b0220cd4924571359521069ff2c56e702d640331dbf3b7feb59e67140bbf310f7c983918da8cde299f61432c67
-
SSDEEP
24576:QtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBFl:t66l2u45BiNYFrz31Cv3D29kd6kcf
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2108 4200 WerFault.exe rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2384 wrote to memory of 4200 2384 rundll32.exe rundll32.exe PID 2384 wrote to memory of 4200 2384 rundll32.exe rundll32.exe PID 2384 wrote to memory of 4200 2384 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO\d3dx9_43.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNICA CENDO RAMA JUDICIAL DEL PODER PÚBLICO ESM CONFIRMAR RECIBIDO\d3dx9_43.dll",#12⤵
- System Location Discovery: System Language Discovery
PID:4200 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 5723⤵
- Program crash
PID:2108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4200 -ip 42001⤵PID:2416