06a7c03d5bdd96a30a32cff0ae0f587fb0e7553b40c43034b90559584adc921f

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 16:49

Target

msvcr110.dll
Size

842KB
MD5

80e987dbe08677e2ec09615cd4358607
SHA1

d2109b7a238ae75545c7a43f863ead710b00b323
SHA256

8a06500612ce1bb0aecf052dcccce619c85be7732cbaeac4d6b26b6ae2cc7f7b
SHA512

cb876bcddb2abd97d247efca8fa602d9edf0b63fad12ebb1f4f3426e227b0a35f35db19cba2a51f4f8124df435fdcf8844728dc883ebf3662b20393958345a45
SSDEEP

12288:xmCyHnj9n4Bljr2GcLnDtv+NqjJ+RBsEOhB7YEu0AU0yx7of3K4lpmZS:xmCyHj54Bln2lt2NqjofsbhxYz0APkS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3552	3092	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 228 wrote to memory of 3092	228	rundll32.exe	83
PID 228 wrote to memory of 3092	228	rundll32.exe	83
PID 228 wrote to memory of 3092	228	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcr110.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcr110.dll,#1
  2⤵
  PID:3092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 600
    3⤵
    - Program crash
    PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3092 -ip 3092
1⤵
PID:2732