1554b5802968fdb2705a67cbb61585e9560b9e429d043a5aa742ef3c9bbfb6bf

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/10/2022, 14:10

Target

vcruntime140_1.dll
Size

36KB
MD5

37c372da4b1adb96dc995ecb7e68e465
SHA1

6c1b6cb92ff76c40c77f86ea9a917a5f854397e2
SHA256

1554b5802968fdb2705a67cbb61585e9560b9e429d043a5aa742ef3c9bbfb6bf
SHA512

926f081b1678c15dc649d7e53bfbe98e4983c9ad6ccdf11c9383ca1d85f2a7353d5c52bebf867d6e155ff897f4702fc4da36a8f4cf76b00cb842152935e319a6
SSDEEP

384:5GnvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbRuncS74G5WreKWn14gHc:rCm5yhUcwrHY/ntTxT6ovq7nt+dN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1008	1076	WerFault.exe	17

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1008	1076	rundll32.exe	28
PID 1076 wrote to memory of 1008	1076	rundll32.exe	28
PID 1076 wrote to memory of 1008	1076	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1076 -s 84
  2⤵
  - Program crash
  PID:1008