d01f1d377ac014cf17e0a72978933463eb242d044faa0b796891841da48508fa

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 10:27

Target

OFICIO Nro 219 NOTIFICACIÓN JUDICIAL AUTO ADMISORIO DEMANDA LABORAL ESM/libcrypto-1_1-x64.dll
Size

2.7MB
MD5

28dea3e780552eb5c53b3b9b1f556628
SHA1

55dccd5b30ce0363e8ebdfeb1cca38d1289748b8
SHA256

52415829d85c06df8724a3d3d00c98f12beabf5d6f3cbad919ec8000841a86e8
SHA512

19dfe5f71901e43ea34d257f693ae1a36433dbdbcd7c9440d9b0f9eea24de65c4a8fe332f7b88144e1a719a6ba791c2048b4dd3e5b1ed0fdd4c813603ad35112
SSDEEP

49152:KlOh5PuX2I9Rkf5gnQ7duzGuqFCtLQ2IqNPz38JQ41CPwDv3uFfJ:Q2Irkn2Iqt38C41CPwDv3uFfJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3040 wrote to memory of 2176	3040	rundll32.exe	WerFault.exe
PID 3040 wrote to memory of 2176	3040	rundll32.exe	WerFault.exe
PID 3040 wrote to memory of 2176	3040	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\OFICIO Nro 219 NOTIFICACIÓN JUDICIAL AUTO ADMISORIO DEMANDA LABORAL ESM\libcrypto-1_1-x64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3040 -s 104
  2⤵
  PID:2176