9b570603035afe928824e50b04cd7f2ef91240dbd7a03bf056e202b9e7193896

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-03-2023 18:37

Target

vcruntime140.dll
Size

371KB
MD5

ac5f699d4ea4a05d5c8027f31fd1b511
SHA1

ad3f17abcbe3a5bb824e8f700adfa49d1822b1ce
SHA256

55ddd290b0b373e875c0482548a8ddc0e0cb2fad34024146cffddb89657914c1
SHA512

624cb512066b2a00701a14db9595d2d61b9438eb1f7c138e08e97178320cb73402ce7001b855e949d33b61c14484e06c2ef3b453f5655d5beaf623cbdfa94f4a
SSDEEP

6144:cTZ+TCHgeecbKF0FpbmGWF5PBpj3FEOr6BeJetJXYwSA3M9Z/xN9di46bgjYBgTT:cTZ+ZDG4NezDt5XtcvxN9div0Y2f

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

848 1700 WerFault.exe rundll32.exe

pid	pid_target	process	target process
848	1700	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1700 wrote to memory of 848	1700	rundll32.exe	WerFault.exe
PID 1700 wrote to memory of 848	1700	rundll32.exe	WerFault.exe
PID 1700 wrote to memory of 848	1700	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1700 -s 84
2⤵
- Program crash
PID:848