Analysis

  • max time kernel
    143s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 11:27

General

  • Target

    $SYSDIR/msvcp60.dll

  • Size

    404KB

  • MD5

    59a6413fb2cc89fd8651b1d2962fb8b9

  • SHA1

    7e118606f03a591897e014b7693d64e6a86fdbe0

  • SHA256

    fed76003f544525783796a22a07b190a8340874c11b5cf1999196c697d51e154

  • SHA512

    83e7ea9905214081793c2a241b776a29dab58ba6ce279ceb3851347004c4ae99cf33fb77f12c7d7474de32d417686f8ba5624a7bd7cec73f3dcab55adae307b5

  • SSDEEP

    6144:RL9LoZGObfGc6z8TEQGpX+3OoxHkCm1N8Reo:DLmBet4wTpX+3OoxHkCmceo

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\msvcp60.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\msvcp60.dll,#1
      2⤵
        PID:2252
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 600
          3⤵
          • Program crash
          PID:4648
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2252 -ip 2252
      1⤵
        PID:4860

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2252-0-0x00000000010D0000-0x0000000001135000-memory.dmp
        Filesize

        404KB