d12a8a14f5ee977e2eea9f2f41d1a611a515e977ae4d5dfe354a6976ff4882bd

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 10:27

Target

Oficio 391 NOTIFICACIÓN ELECTRÓNICA CENDO RAMA RADICADO 153153135 000 6562/MigrationLibrary.dll
Size

107KB
MD5

86d02c85056a2f0540babc63212bb1b6
SHA1

0b622c4943c8cc31cbcdbfec5324d4d7495cc94f
SHA256

ea748caf0ed2aac4008ccb9fd9761993f9583e3bc35783cfa42593e6ba3eb393
SHA512

359476a5d66e97ed21b1f0b2ea80ed6e791ab531a215b1eba8e32ca97258c471a7b74ecfc86f964f31d07e6b8cbfe16dd0b5bacce282ed801a1c59bb605e0367
SSDEEP

1536:2FCb5MQDySAmIfBYkemithpg5E+FrdAAdIDSpQZifWrUYiQxYaBW2OlRbvb:2FE5yrfSmitoGypDIDTQcBW2OlRb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2876 wrote to memory of 1748	2876	rundll32.exe	30
PID 2876 wrote to memory of 1748	2876	rundll32.exe	30
PID 2876 wrote to memory of 1748	2876	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Oficio 391 NOTIFICACIÓN ELECTRÓNICA CENDO RAMA RADICADO 153153135 000 6562\MigrationLibrary.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2876 -s 172
  2⤵
  PID:1748