990ff8d1465fa4d17994890d0503bb9f828aafbc0102203b6b5195015fac113b

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 16:58

Target

mail_change/VCRUNTIME140.dll
Size

106KB
MD5

4585a96cc4eef6aafd5e27ea09147dc6
SHA1

489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256

a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512

d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP

1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2828	2576	rundll32.exe	28
PID 2576 wrote to memory of 2828	2576	rundll32.exe	28
PID 2576 wrote to memory of 2828	2576	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mail_change\VCRUNTIME140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2576 -s 84
  2⤵
  PID:2828