fdebbf313b6c8bf7a2db3ef7a19425c32ce87c5874b5d62ea65e4c0dacfa175a

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 07:41

Target

URGENTE Oficio 391 NOTIFICACIÓN ELECTRÓNICA CENDO RAMA RADICADO 153153135 000 6562/msvcr100.dll
Size

809KB
MD5

366fd6f3a451351b5df2d7c4ecf4c73a
SHA1

50db750522b9630757f91b53df377fd4ed4e2d66
SHA256

ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5
SHA512

2de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130
SSDEEP

12288:QgzGPEett9Mw9HfBCddjMb2NQVmTW75JfmyyKWeHQGoko+1:HzJetPMw9HfBCrMb2Kc6dmyyKWewGzB1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2580	2540	rundll32.exe	29
PID 2540 wrote to memory of 2580	2540	rundll32.exe	29
PID 2540 wrote to memory of 2580	2540	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\URGENTE Oficio 391 NOTIFICACIÓN ELECTRÓNICA CENDO RAMA RADICADO 153153135 000 6562\msvcr100.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2540 -s 80
  2⤵
  PID:2580