b5b526b4b8c2d4396a91d7daf5f5fe804538c001087d8c4b32e01899b396b6b3 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 05:09

Sharing

Report Analysis Logs

General

Target

vcpruntime120.dll
Size

3.1MB
MD5

1518a1f00015502c2b5631f12336a48f
SHA1

9a2fdc1e799e32e51b4e28c2e75a9f0aa50d6fc6
SHA256

d7e4e70989b0a40cb720900c7bea1a9f76a7cbcc4184613a05d8db7af399c802
SHA512

c1157123853949b78be71f0b2fbfc5db8eeaab3ec810b7c779de991007523ffa2537034592ba0244da837a25c3cebe4430336b0d47e06925ce0012aed6c99366

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1328 1472 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1472 wrote to memory of 1328	1472	rundll32.exe	WerFault.exe
PID 1472 wrote to memory of 1328	1472	rundll32.exe	WerFault.exe
PID 1472 wrote to memory of 1328	1472	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcpruntime120.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1472 -s 100
2⤵
- Program crash
PID:1328

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-54-0x0000000000000000-mapping.dmp

Download