316f169de869e16b0abc875bb3d60fb13b3be8509455ae5ceb65b9e4ccfb348c

Analysis

max time kernel
93s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 08:54

Target

PROCESO DEMANDA FRAUDE FISCAL/QtCoreVBox4.dll
Size

2.9MB
MD5

54248bf77daee7d7c5619d9f285a1a9f
SHA1

14067d093fd36f5b021e3bd0c1623c5d747705ec
SHA256

e74616134806b6ebd473f950183ecb6908c3a6312676921176e9aa56e50d21f6
SHA512

054e246c84e1f337e640ed2c6513ff5ef2f285aabfd5debf5e1f0e5b141a20f6849ce9e8b9462332583a2f092a9d1359fae76f9496e6c844070e283caf4313a3
SSDEEP

49152:tNjXLRd49Rm2xEcjfMeTNaMJsv6tWKFdu9C5ToLyvL/6mShMZtmjNUVrciV5P+7H:tNRifJsv6tWKFdu9C5Mf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1760 wrote to memory of 1732	1760	rundll32.exe	WerFault.exe
PID 1760 wrote to memory of 1732	1760	rundll32.exe	WerFault.exe
PID 1760 wrote to memory of 1732	1760	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA FRAUDE FISCAL\QtCoreVBox4.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1760 -s 124
  2⤵
  PID:1732