b5b526b4b8c2d4396a91d7daf5f5fe804538c001087d8c4b32e01899b396b6b3 | Triage

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 05:09

Sharing

Report Analysis Logs

General

Target

vcruntime140_1.dll
Size

43KB
MD5

6bc084255a5e9eb8df2bcd75b4cd0777
SHA1

cf071ad4e512cd934028f005cabe06384a3954b6
SHA256

1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
SHA512

b822538494d13bda947655af791fed4daa811f20c4b63a45246c8f3befa3ec37ff1aa79246c89174fe35d76ffb636fa228afa4bda0bd6d2c41d01228b151fd89

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1756 1948 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1948 wrote to memory of 1756	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 1756	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 1756	1948	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1948 -s 84
2⤵
- Program crash
PID:1756

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-54-0x0000000000000000-mapping.dmp

Download