5d6ba62520f66e70ee281b44342d4271eb98a9b9a5c50e61c28d84c86eb21958

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/04/2024, 13:51

Target

Snake2Virus/VCRUNTIME140.dll
Size

91KB
MD5

7942be5474a095f673582997ae3054f1
SHA1

e982f6ebc74d31153ba9738741a7eec03a9fa5e8
SHA256

8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
SHA512

49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039
SSDEEP

1536:bS6NH9M7vShoxXqYGZLAy10i5XNS83NT/sM9MYDiRecbbVKKoB98:bFRmxXqX0yvX7mHYWRecbb8l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 1736	1136	rundll32.exe	28
PID 1136 wrote to memory of 1736	1136	rundll32.exe	28
PID 1136 wrote to memory of 1736	1136	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Snake2Virus\VCRUNTIME140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1136 -s 84
  2⤵
  PID:1736