92568303c5f9880d3c36c8f1e25516f1d51809598394fcc3b39f3cf36afd03d5

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 08:35

Target

__TEMP/msvcp140.dll
Size

551KB
MD5

e0d7fbc2cbe2ed088725d4436d69e689
SHA1

72c4c13e710311cbd2824eab6543f0e088a84f5f
SHA256

dad53a78662707d182cdb230e999ef6effc0b259def31c196c51cc3e8c42a9b8
SHA512

dfa761e57950d0033e9404ce7d0cf002345e596a9257e319226a5296c0d39b2203167b9ca4f4ed4860c8c47f591be34e1ccbc2e9e7db2ea4577e031120ef7dec
SSDEEP

12288:Q/Wn7JnU0QUgqtLe1fqSKnqEXG6IOaaal7wC/QaDWxncycIW6z9y5QEKZm+jWod4:GN59IW6z9OQEKZm+jWodEEYn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2004 wrote to memory of 2352	2004	rundll32.exe	WerFault.exe
PID 2004 wrote to memory of 2352	2004	rundll32.exe	WerFault.exe
PID 2004 wrote to memory of 2352	2004	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__TEMP\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2004 -s 80
2⤵
PID:2352