Overview
overview
10Static
static
3NOTIFICACI...ca.exe
windows7-x64
10NOTIFICACI...ca.exe
windows10-2004-x64
10NOTIFICACI...ib.dll
windows7-x64
3NOTIFICACI...ib.dll
windows10-2004-x64
3NOTIFICACI...Db.dll
windows7-x64
3NOTIFICACI...Db.dll
windows10-2004-x64
3NOTIFICACI...el.dll
windows7-x64
3NOTIFICACI...el.dll
windows10-2004-x64
3NOTIFICACI...ib.dll
windows7-x64
3NOTIFICACI...ib.dll
windows10-2004-x64
3NOTIFICACI...ls.dll
windows7-x64
3NOTIFICACI...ls.dll
windows10-2004-x64
3NOTIFICACI...ls.dll
windows7-x64
3NOTIFICACI...ls.dll
windows10-2004-x64
3NOTIFICACI...49.dll
windows7-x64
3NOTIFICACI...49.dll
windows10-2004-x64
3NOTIFICACI...71.dll
windows7-x64
3NOTIFICACI...71.dll
windows10-2004-x64
3NOTIFICACI...71.dll
windows7-x64
3NOTIFICACI...71.dll
windows10-2004-x64
3NOTIFICACI...t6.dll
windows7-x64
3NOTIFICACI...t6.dll
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
15-11-2024 05:00
Static task
static1
Behavioral task
behavioral1
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/00014 NotificacionElectronica.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/00014 NotificacionElectronica.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/MCoreLib.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/MCoreLib.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/MDb.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/MDb.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/MKernel.dll
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/MKernel.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/MUICoreLib.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/MUICoreLib.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/MUIUtils.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/MUIUtils.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/MUtils.dll
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/MUtils.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/coolcore49.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/coolcore49.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/msvcp71.dll
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/msvcp71.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/msvcr71.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/msvcr71.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/xprt6.dll
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/xprt6.dll
Resource
win10v2004-20241007-en
General
-
Target
NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15/MUtils.dll
-
Size
619KB
-
MD5
6da9a492898b66db78f5c9d3fc7ecc64
-
SHA1
d264f67d92ccd4cfeaed1510ed0b6ae90d3f7db4
-
SHA256
50dfc607913a47dd266e27f6533f3f6b8f9fe995582f7662a944149a26b5054c
-
SHA512
11bc138d16f279d70ece09e3d238ce891bc5015b6d49a750e153c2b9286bf95e285e818ed5e25e7c731cdfff1324cdb74155f68fda0ef8104eb0d554e2b2923e
-
SSDEEP
12288:OM9gTRuz4D8LNPKworLS82aZkg33/IbH:aTR5QPRYdkZb
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2140 2124 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2124 1968 rundll32.exe 30 PID 1968 wrote to memory of 2124 1968 rundll32.exe 30 PID 1968 wrote to memory of 2124 1968 rundll32.exe 30 PID 1968 wrote to memory of 2124 1968 rundll32.exe 30 PID 1968 wrote to memory of 2124 1968 rundll32.exe 30 PID 1968 wrote to memory of 2124 1968 rundll32.exe 30 PID 1968 wrote to memory of 2124 1968 rundll32.exe 30 PID 2124 wrote to memory of 2140 2124 rundll32.exe 31 PID 2124 wrote to memory of 2140 2124 rundll32.exe 31 PID 2124 wrote to memory of 2140 2124 rundll32.exe 31 PID 2124 wrote to memory of 2140 2124 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15\MUtils.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNCIA JUDICIAL ESM AGRADECEMOS CONFIRMAR RECIBIDO 15\MUtils.dll",#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 2323⤵
- Program crash
PID:2140
-
-