66e9f4d03e67dbcbd9d3a13bfc45b2c11e712b677e990e8ea1b405b60a3a40b2

Analysis

max time kernel
1385s
max time network
1174s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 09:34

Target

Resources/msvcr100d.dll
Size

1.4MB
MD5

2f32b95aeeb4b080230a85b89df84576
SHA1

90649e1daec5eec6f58a4473d6cd573720247b0e
SHA256

ef4c12e4582aa3dc5c5674ac0aa2dcb4829a404edb5d1ca31f258ad7791fc260
SHA512

d43aca77b93999856678efd1bcf016ad8eb47482273740d7b077fea3f48dff8523b2524a8db8a92bc4c2519c446362ffe32783b18850f9984a6900e3269acab5
SSDEEP

24576:Cm/wTbJniLOB8QyruNelIQrTLGA1IZxvW6q9yNxsjcLO++yR6lPUoLpmLy4fx:C18QyruNwrXGAujvn84qcOv4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
524	2312	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2312	2052	rundll32.exe	89
PID 2052 wrote to memory of 2312	2052	rundll32.exe	89
PID 2052 wrote to memory of 2312	2052	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resources\msvcr100d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resources\msvcr100d.dll,#1
  2⤵
  PID:2312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 600
    3⤵
    - Program crash
    PID:524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2312 -ip 2312
1⤵
PID:4740