06a7c03d5bdd96a30a32cff0ae0f587fb0e7553b40c43034b90559584adc921f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 16:49

Target

msvcr110.dll
Size

842KB
MD5

80e987dbe08677e2ec09615cd4358607
SHA1

d2109b7a238ae75545c7a43f863ead710b00b323
SHA256

8a06500612ce1bb0aecf052dcccce619c85be7732cbaeac4d6b26b6ae2cc7f7b
SHA512

cb876bcddb2abd97d247efca8fa602d9edf0b63fad12ebb1f4f3426e227b0a35f35db19cba2a51f4f8124df435fdcf8844728dc883ebf3662b20393958345a45
SSDEEP

12288:xmCyHnj9n4Bljr2GcLnDtv+NqjJ+RBsEOhB7YEu0AU0yx7of3K4lpmZS:xmCyHj54Bln2lt2NqjofsbhxYz0APkS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2816	280	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 2964 wrote to memory of 280	2964	rundll32.exe	28
PID 280 wrote to memory of 2816	280	rundll32.exe	29
PID 280 wrote to memory of 2816	280	rundll32.exe	29
PID 280 wrote to memory of 2816	280	rundll32.exe	29
PID 280 wrote to memory of 2816	280	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcr110.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcr110.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 280 -s 220
    3⤵
    - Program crash
    PID:2816