f07bf397abd8b6bed01b838c3f332319c997f810ee5ec5087e761f1ccc39641a

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 01:15

Target

msvcp140.dll
Size

437KB
MD5

dc739066c9d0ca961cba2f320cade28e
SHA1

81ed5f7861e748b90c7ae2d18da80d1409d1fa05
SHA256

74e9268a68118bb1ac5154f8f327887715960ccc37ba9dabbe31ecd82dcbaa55
SHA512

4eb181984d989156b8703fd8bb8963d7a5a3b7f981fe747c6992993b7a1395a21f45dbedf08c1483d523e772bdf41330753e1771243b53da36d2539c01171cf1
SSDEEP

12288:kKB+zFjoLcAtFSYy9PA7TEsnmLIxhUgiW6QR7t5s03Ooc8dHkC2eszslz:kKMzFj4tFSYyO7TEsnmLIe03Ooc8dHkw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2376	2724	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2724	2868	rundll32.exe	27
PID 2868 wrote to memory of 2724	2868	rundll32.exe	27
PID 2868 wrote to memory of 2724	2868	rundll32.exe	27
PID 2868 wrote to memory of 2724	2868	rundll32.exe	27
PID 2868 wrote to memory of 2724	2868	rundll32.exe	27
PID 2868 wrote to memory of 2724	2868	rundll32.exe	27
PID 2868 wrote to memory of 2724	2868	rundll32.exe	27
PID 2724 wrote to memory of 2376	2724	rundll32.exe	28
PID 2724 wrote to memory of 2376	2724	rundll32.exe	28
PID 2724 wrote to memory of 2376	2724	rundll32.exe	28
PID 2724 wrote to memory of 2376	2724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 224
    3⤵
    - Program crash
    PID:2376