81610cb0050c847dfd3711ee87b929fbd3aaba18cdea3e2d07775ccb9abb04a4

Analysis

max time kernel
22s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-03-2023 07:15

Target

Clangen/VCRUNTIME140_1.dll
Size

35KB
MD5

9cff894542dc399e0a46dee017331edf
SHA1

d1e889d22a5311bd518517537ca98b3520fc99ff
SHA256

b1d3b6b3cdeb5b7b8187767cd86100b76233e7bbb9acf56c64f8288f34b269ca
SHA512

ca254231f12bdfc300712a37d31777ff9d3aa990ccc129129fa724b034f3b59c88ed5006a5f057348fa09a7de4a0c2e0fb479ce06556e2059f919ddd037f239e
SSDEEP

384:nNn62MCmWEPhUcSLt5a9Y6v4HOE5fY/ntz5BBW0O3+XfeuncS79+pWrQKWhD/HRj:YdCm5PhUcxgHY/ntXBzxvV7KtDvCTO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1164	1160	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1164	1160	rundll32.exe	27
PID 1160 wrote to memory of 1164	1160	rundll32.exe	27
PID 1160 wrote to memory of 1164	1160	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clangen\VCRUNTIME140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1160 -s 84
  2⤵
  - Program crash
  PID:1164