e7490d25eb3e1553ec66c42b1474a2ff025072f3017eb882f7b15da0379ce9e0 | Triage

Analysis

max time kernel
1382s
max time network
1174s
platform
windows10-2004_x64
resource
win10v2004-20240221-uk
resource tags

arch:x64arch:x86image:win10v2004-20240221-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
25-02-2024 20:41

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/msvcp140_1.dll
Size

28KB
MD5

baeb5294985628e64660cbc1eb8a5c92
SHA1

a69e5cc6a51fe90309664a0bf4d05a70956041fd
SHA256

6527b9b5a1b7d08b537375dada65bc79f6b6a9bceca55bc28f44eada20e4ce8d
SHA512

b234b03dbe25ed4265c9f08e9efbb9d94a1077142bc6780162f6b1df547c9dfc37a7342f70e8ec55c7c3b97f73ce819e979bd13f3b43c311df4555150d53de29
SSDEEP

384:ksmpXUJuJv+VWcn53WeZwyRgAQpBj0HRN750QHRN7u7ll6JpIm4:aUUJvSRhqW5082

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4040 wrote to memory of 4508	4040	rundll32.exe	rundll32.exe
PID 4040 wrote to memory of 4508	4040	rundll32.exe	rundll32.exe
PID 4040 wrote to memory of 4508	4040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\msvcp140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\msvcp140_1.dll,#1
2⤵
PID:4508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...