18c74dde6426a0637bbdfff078e677fe9813391e7db685735f90cc42ac1cd231

Resubmissions

18-02-2024 15:25

18-02-2024 15:19

18-02-2024 14:45

max time kernel
44s
max time network
17s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18-02-2024 15:19

Target

Minty/dll/vcruntime140_1.dll
Size

36KB
MD5

135359d350f72ad4bf716b764d39e749
SHA1

2e59d9bbcce356f0fece56c9c4917a5cacec63d7
SHA256

34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
SHA512

cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba
SSDEEP

384:5hnvMCmWEKhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+Xf0+uncS7IO5WrCKWU/tQ0g:YCm5KhUcwrHY/ntTxT6ov07b4SwY1zl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2080	1972	rundll32.exe	19
PID 1972 wrote to memory of 2080	1972	rundll32.exe	19
PID 1972 wrote to memory of 2080	1972	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Minty\dll\vcruntime140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1972 -s 80
  2⤵
  PID:2080