e8f18a59a3c4a7b9d8f00c203d1c3cecb8b2353d79ba6546e78084796e36f56f | Triage

Resubmissions

23-02-2024 14:34

240223-rxp3paca7y 7

25-01-2024 16:04

240125-th1a8abbek 10

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:04

Sharing

Report Analysis Logs

General

Target

bin/concrt140.dll
Size

310KB
MD5

cd12471b295f6a1c66dcc9fc519eef5b
SHA1

dbca64bc390ea30d54c184086f0505fef35cd969
SHA256

573229a07f38ab9d2fc2e1a5b98e9243b9b39100323180c83ad7ddaf98eee46a
SHA512

c8a75f285e12f3e65ea18b002d4661f01ebf54d464fec761917ac09709ff6005f0e15bf76756ccde8d19fe88f096d05df20bab252bb2c26248af5aaad846b988
SSDEEP

6144:1EI93zcNn3dMiBXHxHSSXfPnevwbbeVu00Xp9gznWzgQQf3P2iyK:aIlwNqihUSPPd9z8yK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2064 wrote to memory of 2224	2064	rundll32.exe	WerFault.exe
PID 2064 wrote to memory of 2224	2064	rundll32.exe	WerFault.exe
PID 2064 wrote to memory of 2224	2064	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\concrt140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2064 -s 80
2⤵
PID:2224

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...