fdebbf313b6c8bf7a2db3ef7a19425c32ce87c5874b5d62ea65e4c0dacfa175a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 07:38

Target

URGENTE Oficio 391 NOTIFICACIÓN ELECTRÓNICA CENDO RAMA RADICADO 153153135 000 6562/MigrationLibrary.dll
Size

107KB
MD5

86d02c85056a2f0540babc63212bb1b6
SHA1

0b622c4943c8cc31cbcdbfec5324d4d7495cc94f
SHA256

ea748caf0ed2aac4008ccb9fd9761993f9583e3bc35783cfa42593e6ba3eb393
SHA512

359476a5d66e97ed21b1f0b2ea80ed6e791ab531a215b1eba8e32ca97258c471a7b74ecfc86f964f31d07e6b8cbfe16dd0b5bacce282ed801a1c59bb605e0367
SSDEEP

1536:2FCb5MQDySAmIfBYkemithpg5E+FrdAAdIDSpQZifWrUYiQxYaBW2OlRbvb:2FE5yrfSmitoGypDIDTQcBW2OlRb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2256	2452	rundll32.exe	31
PID 2452 wrote to memory of 2256	2452	rundll32.exe	31
PID 2452 wrote to memory of 2256	2452	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\URGENTE Oficio 391 NOTIFICACIÓN ELECTRÓNICA CENDO RAMA RADICADO 153153135 000 6562\MigrationLibrary.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2452 -s 160
  2⤵
  PID:2256