5aa317d3682ff127e1e92d2016c08f94be60937a1b8a210876d931d072386336

Analysis

max time kernel
119s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 05:27

Target

Job Interview/vcruntime140.dll
Size

77KB
MD5

f686e2331a83d20798cfc2734729e531
SHA1

c7e6398f5a735039baabf22712c5a8aee5a945e1
SHA256

535f74f446a1b7b53da24a742d02369cbcc609003a6b4a8175491aa71c5481b4
SHA512

30ea339ec845dbc9aa7b323ed25e516cb04f3e17789cd28f54646c82395f0b42eb4a5d4d4aa06c4d39b9602c37590b31ca5c0bfa22a514a73ec45e39c0d8e31a
SSDEEP

1536:l9W/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86k+P8iB:l9W/j28V55At/zqw+IqLUecbAdz8gP8e

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3020 1660 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3020	1660	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1964 wrote to memory of 1660	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1660	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1660	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1660	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1660	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1660	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1660	1964	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 3020	1660	rundll32.exe	WerFault.exe
PID 1660 wrote to memory of 3020	1660	rundll32.exe	WerFault.exe
PID 1660 wrote to memory of 3020	1660	rundll32.exe	WerFault.exe
PID 1660 wrote to memory of 3020	1660	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Job Interview\vcruntime140.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Job Interview\vcruntime140.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 224
3⤵
- Program crash
PID:3020