f07bf397abd8b6bed01b838c3f332319c997f810ee5ec5087e761f1ccc39641a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 01:15

Target

concrt140.dll
Size

7.3MB
MD5

66e4d1076963f85b9ce83b2c5de45543
SHA1

bdb2a7b5e3e151839652d6fe18a76832aecea0a5
SHA256

fbc4074ffc36cbb2e4d23200d5b91d2fedc4c037dfcae21ce6e5c54d2295ceb7
SHA512

5b3ec6ed13ed1e3aaa22223f6440621e7a5ba906a4d6b933f1cee96bee33ad2ab80fa45de11f809b1e3721049c6bcab117ad8d1835d8588113c34ad4a363bddb
SSDEEP

49152:5eA/z2/jH2mnqxjsMYP9TQgNgokTKWcnMNWz/6UGM+4+eXGIWh4uw4y4q7WkXc8W:Ig

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	2316	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2316	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28
PID 1540 wrote to memory of 2316	1540	rundll32.exe	28
PID 2316 wrote to memory of 1960	2316	rundll32.exe	29
PID 2316 wrote to memory of 1960	2316	rundll32.exe	29
PID 2316 wrote to memory of 1960	2316	rundll32.exe	29
PID 2316 wrote to memory of 1960	2316	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\concrt140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\concrt140.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 220
    3⤵
    - Program crash
    PID:1960