e8f18a59a3c4a7b9d8f00c203d1c3cecb8b2353d79ba6546e78084796e36f56f | Triage

Resubmissions

23/02/2024, 14:34

240223-rxp3paca7y 7

25/01/2024, 16:04

240125-th1a8abbek 10

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 16:04

Sharing

Report Analysis Logs

General

Target

bin/concrt140.dll
Size

310KB
MD5

cd12471b295f6a1c66dcc9fc519eef5b
SHA1

dbca64bc390ea30d54c184086f0505fef35cd969
SHA256

573229a07f38ab9d2fc2e1a5b98e9243b9b39100323180c83ad7ddaf98eee46a
SHA512

c8a75f285e12f3e65ea18b002d4661f01ebf54d464fec761917ac09709ff6005f0e15bf76756ccde8d19fe88f096d05df20bab252bb2c26248af5aaad846b988
SSDEEP

6144:1EI93zcNn3dMiBXHxHSSXfPnevwbbeVu00Xp9gznWzgQQf3P2iyK:aIlwNqihUSPPd9z8yK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2224	2064	rundll32.exe	28
PID 2064 wrote to memory of 2224	2064	rundll32.exe	28
PID 2064 wrote to memory of 2224	2064	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\concrt140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2064 -s 80
  2⤵
  PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads