b5b526b4b8c2d4396a91d7daf5f5fe804538c001087d8c4b32e01899b396b6b3 | Triage

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 05:09

Sharing

Report Analysis Logs

General

Target

msvcp140_codecvt_ids.dll
Size

26KB
MD5

df62e520457181f680a05aa1938ad102
SHA1

7005e0efda58a0860b290d82bea32ee5eb6c6e51
SHA256

92a13ba41b543a5915e79a05a630bbb28c4c90e59bc02c761dc1fd4329c23a9a
SHA512

80073b0cacb5adb1588ce7c8aefdc9ced3a341f7d80fdf92def3baa550114dd381ca435bdfe28d43a6b2ccc4ce2fbed8a4e8e860c7606b75d14fc416191923f9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1692 2016 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2016 wrote to memory of 1692	2016	rundll32.exe	WerFault.exe
PID 2016 wrote to memory of 1692	2016	rundll32.exe	WerFault.exe
PID 2016 wrote to memory of 1692	2016	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140_codecvt_ids.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2016 -s 84
2⤵
- Program crash
PID:1692

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-54-0x0000000000000000-mapping.dmp

Download