7947ce427da5fb9120688f68d391f64a393cfb56b77ab15f585bd3fe43273782

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 22:10

Target

Bin/Aim/_internal/VCRUNTIME140.dll
Size

116KB
MD5

be8dbe2dc77ebe7f88f910c61aec691a
SHA1

a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256

4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512

0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP

1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1744	1288	rundll32.exe	28
PID 1288 wrote to memory of 1744	1288	rundll32.exe	28
PID 1288 wrote to memory of 1744	1288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bin\Aim\_internal\VCRUNTIME140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1288 -s 80
  2⤵
  PID:1744