fdebbf313b6c8bf7a2db3ef7a19425c32ce87c5874b5d62ea65e4c0dacfa175a

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 07:41

Target

URGENTE Oficio 391 NOTIFICACIÓN ELECTRÓNICA CENDO RAMA RADICADO 153153135 000 6562/sqlite3.dll
Size

723KB
MD5

c66a7d728dda63a285388f4bd7fd35dc
SHA1

859f3e4c140a76a12ff7fda9b384480cc4479b7e
SHA256

eda647ca391f1a46070e6ff493d6e1b6a28320ed6758f9b08bd3474519f1544c
SHA512

e58c5ca8a3275c9d5ba59f04a8c6aabdac6c8adeca162588166da52e90f7cabf5616a0ca8cb2430a6885d36e4cbb16a5d6bb8c5979d86444686f09045d958765
SSDEEP

12288:BEQuQ2u+RQ88mBN18qc7EWQ3IsAmRCaliLyaoeSzjYDqnWXTjFCAM+tAAPOA:BRhfONOpweDDcWXTRCAU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2212	2124	rundll32.exe	30
PID 2124 wrote to memory of 2212	2124	rundll32.exe	30
PID 2124 wrote to memory of 2212	2124	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\URGENTE Oficio 391 NOTIFICACIÓN ELECTRÓNICA CENDO RAMA RADICADO 153153135 000 6562\sqlite3.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2124 -s 160
  2⤵
  PID:2212