0d6870a3d1b27ae23c9e2c413fb2b367b69323ead81bf38524a54cc17e8a809b | Triage

Analysis

max time kernel
62s
max time network
45s
platform
windows7_x64
resource
win7-20220331-en
submitted
13-04-2022 00:45

Sharing

Report Analysis Logs

General

Target

msvcp140.dll
Size

446KB
MD5

4835a9b8749970d0ad04f22a546042af
SHA1

f89d579c0b0c4afe2ca8283d222f44051d2e7c94
SHA256

fa21058e50d0d6860da87d784f573670bf5d3efd65158145954ef96d0cd403cf
SHA512

7379678fd9454bac2042e69636718c0c568d61fba40cd0ca064baee044018f007625fb0acfb77d249768c0e36ba1353078167148825df4f4496ecf860e57ce00

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

952 1340 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1296 wrote to memory of 1340	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1340	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1340	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1340	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1340	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1340	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1340	1296	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 952	1340	rundll32.exe	WerFault.exe
PID 1340 wrote to memory of 952	1340	rundll32.exe	WerFault.exe
PID 1340 wrote to memory of 952	1340	rundll32.exe	WerFault.exe
PID 1340 wrote to memory of 952	1340	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 224
3⤵
- Program crash
PID:952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-56-0x0000000000000000-mapping.dmp

Download
memory/1340-54-0x0000000000000000-mapping.dmp

Download
memory/1340-55-0x0000000075A41000-0x0000000075A43000-memory.dmp

Filesize
8KB

Download