f8e4deb1e9246b1b4ced53080a9f9d852d981e937b5b6a33feef70e6685c357b

Analysis

max time kernel
85s
max time network
197s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
11/02/2024, 22:42

Target

WamaCry/msvcp120.dll
Size

433KB
MD5

331c473ccea30867c8b2eed5baf41121
SHA1

6dc05c11909f22444e549c0f265ea88cf7172bb9
SHA256

e24d653d92ca261f7e140591cf75389408d3031126ff50d9697a427b9399c13a
SHA512

a8d03088bfa1ffaebd7e1847a15710a6256f3ab8099210f4caeef8bfd1636aa3504296d9cb65d571c53e921d8833c50a59aaea3a651392389702bf06d780b556
SSDEEP

12288:ZZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77q:j/8wVwHZFTwFOOos3Ooc8DHkC2e77q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4552	1904	WerFault.exe	68

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 1904	416	rundll32.exe	68
PID 416 wrote to memory of 1904	416	rundll32.exe	68
PID 416 wrote to memory of 1904	416	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WamaCry\msvcp120.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WamaCry\msvcp120.dll,#1
  2⤵
  PID:1904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 452
    3⤵
    - Program crash
    PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1904 -ip 1904
1⤵
PID:4312