5aa317d3682ff127e1e92d2016c08f94be60937a1b8a210876d931d072386336

Analysis

max time kernel
14s
max time network
27s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 05:27

Target

Job Interview/vcruntime140.dll
Size

77KB
MD5

f686e2331a83d20798cfc2734729e531
SHA1

c7e6398f5a735039baabf22712c5a8aee5a945e1
SHA256

535f74f446a1b7b53da24a742d02369cbcc609003a6b4a8175491aa71c5481b4
SHA512

30ea339ec845dbc9aa7b323ed25e516cb04f3e17789cd28f54646c82395f0b42eb4a5d4d4aa06c4d39b9602c37590b31ca5c0bfa22a514a73ec45e39c0d8e31a
SSDEEP

1536:l9W/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86k+P8iB:l9W/j28V55At/zqw+IqLUecbAdz8gP8e

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2536 wrote to memory of 2620	2536	rundll32.exe	rundll32.exe
PID 2536 wrote to memory of 2620	2536	rundll32.exe	rundll32.exe
PID 2536 wrote to memory of 2620	2536	rundll32.exe	rundll32.exe
PID 2536 wrote to memory of 2620	2536	rundll32.exe	rundll32.exe
PID 2536 wrote to memory of 2620	2536	rundll32.exe	rundll32.exe
PID 2536 wrote to memory of 2620	2536	rundll32.exe	rundll32.exe
PID 2536 wrote to memory of 2620	2536	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Job Interview\vcruntime140.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Job Interview\vcruntime140.dll",#1
2⤵
PID:2620