b081802bdff2f3e071a578f650b1d1e94b7f9840fb0a3b35cc1977ea01844164 | Triage

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 13:14

Sharing

Report Analysis Logs

General

Target

vcruntime140d.dll
Size

130KB
MD5

ee7fbf8768a87ea64ad4890540ce48f9
SHA1

bcbc1ebd5a592c2df216d3211f309a79f9cd8a9b
SHA256

03eafdf65d672994e592b8acc8a1276ccae1218a5cb9685b9aa6a5ffe1a855fe
SHA512

0cbf346d46b5c0b09c1f3fb4837c8df662bf0c69de8c4ae292b994ec156c91b78dbaad733226d765b1ca3ee1695566dc90bf85086e438fa15b9eb32058abce80
SSDEEP

3072:bg6runAEs8KOSVZK/pXKsGmVecbQyt5mnaZa:bVisVZK/zBVecbQYla

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3056	2840	rundll32.exe	28
PID 2840 wrote to memory of 3056	2840	rundll32.exe	28
PID 2840 wrote to memory of 3056	2840	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2840 -s 96
  2⤵
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads