0d6870a3d1b27ae23c9e2c413fb2b367b69323ead81bf38524a54cc17e8a809b | Triage

Analysis

max time kernel
74s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
13-04-2022 00:45

Sharing

Report Analysis Logs

General

Target

msvcp140.dll
Size

446KB
MD5

4835a9b8749970d0ad04f22a546042af
SHA1

f89d579c0b0c4afe2ca8283d222f44051d2e7c94
SHA256

fa21058e50d0d6860da87d784f573670bf5d3efd65158145954ef96d0cd403cf
SHA512

7379678fd9454bac2042e69636718c0c568d61fba40cd0ca064baee044018f007625fb0acfb77d249768c0e36ba1353078167148825df4f4496ecf860e57ce00

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2288 3900 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2068 wrote to memory of 3900	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 3900	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 3900	2068	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
2⤵
PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 616
3⤵
- Program crash
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3900 -ip 3900
1⤵
PID:1204

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3900-134-0x0000000000000000-mapping.dmp

Download