Overview
overview
10Static
static
3NOTIFICACI...ca.exe
windows7-x64
10NOTIFICACI...ca.exe
windows10-2004-x64
10NOTIFICACI...re.dll
windows7-x64
1NOTIFICACI...re.dll
windows10-2004-x64
1NOTIFICACI...ui.dll
windows7-x64
1NOTIFICACI...ui.dll
windows10-2004-x64
1NOTIFICACI...rk.dll
windows7-x64
1NOTIFICACI...rk.dll
windows10-2004-x64
1NOTIFICACI...rt.dll
windows7-x64
1NOTIFICACI...rt.dll
windows10-2004-x64
1NOTIFICACI...ts.dll
windows7-x64
1NOTIFICACI...ts.dll
windows10-2004-x64
1NOTIFICACI...40.dll
windows7-x64
1NOTIFICACI...40.dll
windows10-2004-x64
1NOTIFICACI...40.dll
windows7-x64
1NOTIFICACI...40.dll
windows10-2004-x64
1NOTIFICACI..._1.dll
windows7-x64
1NOTIFICACI..._1.dll
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 18:26
Static task
static1
Behavioral task
behavioral1
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/000021 Notificacion Electronica.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/000021 Notificacion Electronica.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/Qt5Core.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/Qt5Core.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/Qt5Gui.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/Qt5Gui.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/Qt5Network.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/Qt5Network.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/Qt5PrintSupport.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/Qt5PrintSupport.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/Qt5Widgets.dll
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/Qt5Widgets.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/msvcp140.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/msvcp140.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/vcruntime140.dll
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/vcruntime140.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/vcruntime140_1.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/vcruntime140_1.dll
Resource
win10v2004-20241007-en
General
-
Target
NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21/vcruntime140_1.dll
-
Size
37KB
-
MD5
75e78e4bf561031d39f86143753400ff
-
SHA1
324c2a99e39f8992459495182677e91656a05206
-
SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
-
SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756
-
SSDEEP
768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1800 wrote to memory of 1308 1800 rundll32.exe 30 PID 1800 wrote to memory of 1308 1800 rundll32.exe 30 PID 1800 wrote to memory of 1308 1800 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\NOTIFICACIÓN ELECTRÓNICA ESM AGRADECEMOS CONFIRMAR RECIBIDO 21\vcruntime140_1.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1800 -s 802⤵PID:1308
-