fa09d24d7481dbdfc1cff6aaa92d2aec908e037a22a02346f6feeee5d6ba688e

Analysis

max time kernel
130s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 17:16

Target

Microsoft.VC142.CRT/vcruntime140.dll
Size

74KB
MD5

1a84957b6e681fca057160cd04e26b27
SHA1

8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA256

9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA512

5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
SSDEEP

1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3152 wrote to memory of 3604	3152	rundll32.exe	rundll32.exe
PID 3152 wrote to memory of 3604	3152	rundll32.exe	rundll32.exe
PID 3152 wrote to memory of 3604	3152	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.VC142.CRT\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3152

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.VC142.CRT\vcruntime140.dll,#1
2⤵
PID:3604