fa09d24d7481dbdfc1cff6aaa92d2aec908e037a22a02346f6feeee5d6ba688e | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
19-05-2024 15:21

Sharing

Report Analysis Logs

General

Target

Microsoft.VC142.CRT/msvcp140_1.dll
Size

20KB
MD5

c946a9e4170f6b16d25c822da616dc6a
SHA1

f602d23db756f9c3a058d3b7186d24480e05790f
SHA256

65bdadb5562b9473471740b1dcd8b064459a40d71a1a11fc5aedaa855fe7635a
SHA512

916cad8b1e38b2b15ab836844c5cc9d36b212831b2f553198054fe9cb5cd77aecd544cac8040000337cefda9b15bf95e8903f36a9c1beb7d579cfff670445617
SSDEEP

384:Y32E5mpdhYQjHy3d5Wcs5gWI3KLHRN7QiUJ/AlGstm4s:YmxQSyUyAQX/xEv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3744 wrote to memory of 1352	3744	rundll32.exe	rundll32.exe
PID 3744 wrote to memory of 1352	3744	rundll32.exe	rundll32.exe
PID 3744 wrote to memory of 1352	3744	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.VC142.CRT\msvcp140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.VC142.CRT\msvcp140_1.dll,#1
2⤵
PID:1352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads