9b570603035afe928824e50b04cd7f2ef91240dbd7a03bf056e202b9e7193896

Analysis

max time kernel
24s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-03-2023 18:37

Target

vcruntime140_1.dll
Size

36KB
MD5

7667b0883de4667ec87c3b75bed84d84
SHA1

e6f6df83e813ed8252614a46a5892c4856df1f58
SHA256

04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
SHA512

968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74
SSDEEP

384:5InvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbmuncS74GdWrUKWj14gHg:dCm5yhUcwrHY/ntTxT6ovR7VxIV1z

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2004 1980 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2004	1980	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1980 wrote to memory of 2004	1980	rundll32.exe	WerFault.exe
PID 1980 wrote to memory of 2004	1980	rundll32.exe	WerFault.exe
PID 1980 wrote to memory of 2004	1980	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1980 -s 84
2⤵
- Program crash
PID:2004