5aa317d3682ff127e1e92d2016c08f94be60937a1b8a210876d931d072386336

Analysis

max time kernel
92s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 05:27

Target

Job Interview/vcruntime140.dll
Size

77KB
MD5

f686e2331a83d20798cfc2734729e531
SHA1

c7e6398f5a735039baabf22712c5a8aee5a945e1
SHA256

535f74f446a1b7b53da24a742d02369cbcc609003a6b4a8175491aa71c5481b4
SHA512

30ea339ec845dbc9aa7b323ed25e516cb04f3e17789cd28f54646c82395f0b42eb4a5d4d4aa06c4d39b9602c37590b31ca5c0bfa22a514a73ec45e39c0d8e31a
SSDEEP

1536:l9W/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86k+P8iB:l9W/j28V55At/zqw+IqLUecbAdz8gP8e

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4480 3452 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4480	3452	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1464 wrote to memory of 3452	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 3452	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 3452	1464	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Job Interview\vcruntime140.dll",#1
1⤵
PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 600
2⤵
- Program crash
PID:4480

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Job Interview\vcruntime140.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3452 -ip 3452
1⤵
PID:4188