d87f723d17e0397593ea7560d6a0938e25cddcbc77b9128b90f8a1c871665ef8 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 14:24

Sharing

Report Analysis Logs

General

Target

equil/vcruntime140d.dll
Size

162KB
MD5

54132dd5c5c2bb30c5118164b495529c
SHA1

b491106d246200463f58a3f2211fb51a34cb1b0e
SHA256

b7580fd2d2a607463a1f833f64c3dd599165172c921bf1e5b17927269b3e1b16
SHA512

aa701faf468b282f834fd6a0a06f5310075aabc891c3165f740a4a9ed047aa6cb3dd5c32ccd9504f52b45b06670685ec5cbd7271c46b149e18229141cf75837f
SSDEEP

3072:YttPtZllUjzJeiy24mdiPeIPweecbTRs/:Y4jFZy24fmqweecbT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1932	2008	rundll32.exe	28
PID 2008 wrote to memory of 1932	2008	rundll32.exe	28
PID 2008 wrote to memory of 1932	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\equil\vcruntime140d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2008 -s 80
  2⤵
  PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads