d12a8a14f5ee977e2eea9f2f41d1a611a515e977ae4d5dfe354a6976ff4882bd

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/12/2024, 17:39

Target
Oficio 391 NOTIFICACIÓN ELECTRÓNICA CENDO RAMA RADICADO 153153135 000 6562/MigrationLibrary.dll
Size 107KB
Sample241206-v8d2cavlgn
SHA256 ea748caf0ed2aac4008ccb9fd9761993f9583e3bc35783cfa42593e6ba3eb393
MD5 86d02c85056a2f0540babc63212bb1b6
SHA1 0b622c4943c8cc31cbcdbfec5324d4d7495cc94f
SHA512 359476a5d66e97ed21b1f0b2ea80ed6e791ab531a215b1eba8e32ca97258c471a7b74ecfc86f964f31d07e6b8cbfe16dd0b5bacce282ed801a1c59bb605e0367
SSDEEP 1536:2FCb5MQDySAmIfBYkemithpg5E+FrdAAdIDSpQZifWrUYiQxYaBW2OlRbvb:2FE5yrfSmitoGypDIDTQcBW2OlRb
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2104	1696	rundll32.exe	31
PID 1696 wrote to memory of 2104	1696	rundll32.exe	31
PID 1696 wrote to memory of 2104	1696	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Oficio 391 NOTIFICACIÓN ELECTRÓNICA CENDO RAMA RADICADO 153153135 000 6562\MigrationLibrary.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1696 -s 160
  2⤵
  PID:2104