6c8dfbba2dfc6053ef6de63a3eb88e980c4f31fdbd249d30d854314a666fff30 | Triage

Analysis

max time kernel
52s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 06:14

Sharing

Report Analysis Logs

General

Target

vcomp140.dll
Size

135KB
MD5

6b2739f7a5238c8fb4442355dcfdbb0d
SHA1

eff490909fbea9a3f6593fbf401f797730cea8eb
SHA256

41db8ab344bde359137d6a7d5be5dbf79c4bf2b52d8263c4fad3eac525606ab9
SHA512

f061a61ce4dbc499afbb8f18c2f2af5fd56286399253aa3e2ab86073e22148c56a044167acae81856b48cb03c4cfd060c8e1b74eb958083d182041a7c3e1ea89
SSDEEP

3072:cyrx4kf0ZGQ62xfOW6Z34bL/AmPVgN/7aG5fhqyENt:WGQ+ZaL/m/WXt

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3348	3260	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3260	4508	rundll32.exe	81
PID 4508 wrote to memory of 3260	4508	rundll32.exe	81
PID 4508 wrote to memory of 3260	4508	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcomp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcomp140.dll,#1
  2⤵
  PID:3260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 596
    3⤵
    - Program crash
    PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3260 -ip 3260
1⤵
PID:3096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads