0e58aee5347ec13bc8c760cb266ba8714b208581e87ea08fe4693f3ba60261d7

Analysis

max time kernel
570s
max time network
456s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 05:32

Target

vcruntime140.dll
Size

81KB
MD5

16b26bc43943531d7d7e379632ed4e63
SHA1

565287de39649e59e653a3612478c2186096d70a
SHA256

346f72c9a7584c2ab6ce65cd38a616c77ebddc0bbab2274c4e89dd5e62237517
SHA512

b5b7b4b8c5ab4276a34956e43f586272b1803ec3609253fee1bcc0a549aed7ba11d47404b023f7b67af701726bab95cca55738e7bd5bca272eca5ac71bb418cc
SSDEEP

1536:BDpX0WKXQn6s8/oB6xMSKgS9WnESDPIYMWC/q6mYIeTsu03/huecbFWzZoi:BF0ZQnm/oBab8y6mfe0vhuecbFWzZoi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4404	1824	WerFault.exe	90

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2096	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 1824	876	rundll32.exe	90
PID 876 wrote to memory of 1824	876	rundll32.exe	90
PID 876 wrote to memory of 1824	876	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#1
  2⤵
  PID:1824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 600
    3⤵
    - Program crash
    PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1824 -ip 1824
1⤵
PID:1356

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096

memory/2096-0-0x000002ED35E40000-0x000002ED35E50000-memory.dmp

Filesize
64KB

Download
memory/2096-16-0x000002ED35F40000-0x000002ED35F50000-memory.dmp

Filesize
64KB

Download
memory/2096-32-0x000002ED3E280000-0x000002ED3E281000-memory.dmp

Filesize
4KB

Download
memory/2096-34-0x000002ED3E2B0000-0x000002ED3E2B1000-memory.dmp

Filesize
4KB

Download
memory/2096-35-0x000002ED3E2B0000-0x000002ED3E2B1000-memory.dmp

Filesize
4KB

Download
memory/2096-36-0x000002ED3E3C0000-0x000002ED3E3C1000-memory.dmp

Filesize
4KB

Download