6be7345b807e4eeae54cb7311bbf0b402c4bd1dd761ef6e6e913553b4634ded4

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 06:49

Target

usr/src/trojan-cli/msvcp140.dll
Size

612KB
MD5

ba72c2f6f465926980adc2fb7f8b3490
SHA1

63de0e3c14d0f45c1edab1c3ecd4adfb78ee8cdd
SHA256

86881a7054532019291c162f0a8177980c1c2b45490f7e88543f22915d08d9ff
SHA512

05136a8dde4359efd112341b12e0545accc8d018e4fa7495b071197833a0227bd50879d7753b61582505b8e2286f845604008bd2020e689e148037a9ef7d7474
SSDEEP

12288:lOpw3ob/5jh6lN0RXhsdufjqDZZX/t5xTOKGmm75s79s8gywMQEKZm+jWodEEVo+:r3ob/5jh6lN0RXhsdufjqDZZX/t5xTOh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 860	1556	rundll32.exe	28
PID 1556 wrote to memory of 860	1556	rundll32.exe	28
PID 1556 wrote to memory of 860	1556	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\usr\src\trojan-cli\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1556 -s 80
  2⤵
  PID:860