57e35a9db07b372120acd222627eba20e03d4baa88d5fc098e681ddd98b31e87

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 20:33

Target

file_x86x64_release/msvcp140.dll
Size

576KB
MD5

a11a1d761d757d367146f0f772632d8c
SHA1

9fd3eee4c4111dc386510a930192d56a2e938dfe
SHA256

2cc02c5e6654aa9175d5963f811cac222f4a2604dc28553139c675b1a78995a7
SHA512

6fbbb77766ee9846d6d3bde2ced5eeaafe721de5524a410a4821dfa6c08edbd00905bec2b9237b8f7986d6d06dbe444c5845130193da537cadaf29ea784c48e1
SSDEEP

12288:fFrCZUcfGI/O+bE9krdFFM5lle0dkM4X2n08ukSIAg6wQEKZm+jWodEEVrR+:9rCZUNYX2nSkGg6wQEKZm+jWodEE9R+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2660 wrote to memory of 2740	2660	rundll32.exe	WerFault.exe
PID 2660 wrote to memory of 2740	2660	rundll32.exe	WerFault.exe
PID 2660 wrote to memory of 2740	2660	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file_x86x64_release\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2660 -s 80
2⤵
PID:2740