f07bf397abd8b6bed01b838c3f332319c997f810ee5ec5087e761f1ccc39641a

Analysis

max time kernel
140s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2024 01:15

Target

msvcp140.dll
Size

437KB
MD5

dc739066c9d0ca961cba2f320cade28e
SHA1

81ed5f7861e748b90c7ae2d18da80d1409d1fa05
SHA256

74e9268a68118bb1ac5154f8f327887715960ccc37ba9dabbe31ecd82dcbaa55
SHA512

4eb181984d989156b8703fd8bb8963d7a5a3b7f981fe747c6992993b7a1395a21f45dbedf08c1483d523e772bdf41330753e1771243b53da36d2539c01171cf1
SSDEEP

12288:kKB+zFjoLcAtFSYy9PA7TEsnmLIxhUgiW6QR7t5s03Ooc8dHkC2eszslz:kKMzFj4tFSYyO7TEsnmLIe03Ooc8dHkw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2876	3412	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 3412	4380	rundll32.exe	20
PID 4380 wrote to memory of 3412	4380	rundll32.exe	20
PID 4380 wrote to memory of 3412	4380	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
  2⤵
  PID:3412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 604
    3⤵
    - Program crash
    PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3412 -ip 3412
1⤵
PID:2084