316f169de869e16b0abc875bb3d60fb13b3be8509455ae5ceb65b9e4ccfb348c

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 08:54

Target

PROCESO DEMANDA FRAUDE FISCAL/msvcp100.dll
Size

593KB
MD5

4f096d96285e06cd51aef7d2d3de04da
SHA1

c90ef0eb5b1a0b1b85ad6792291747fb6307dcdb
SHA256

5bb420fbe28315f2117376052bb8488ce84a3398dda65005b8ae1f792017e9a8
SHA512

80f558c50a71ad9c4930b3838b481e4fb453c38d57c91f7f70c1f86e4043b9a4fbcec27d7c025285504cbf3bde7c50b4770f18121d7818ac58e2ee9c2071f97c
SSDEEP

12288:uoBFUsQ1H5FH3YUTd/dfePA7XrNvEKZm+aWodEEGblH6t2:LFUsQ1H5FHdggrNvEKZm+aWodEEIH6t2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1672 wrote to memory of 2840	1672	rundll32.exe	WerFault.exe
PID 1672 wrote to memory of 2840	1672	rundll32.exe	WerFault.exe
PID 1672 wrote to memory of 2840	1672	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA FRAUDE FISCAL\msvcp100.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1672 -s 80
  2⤵
  PID:2840