95b5d0e36464afc8391a9d056926e5859506ead18937669554bde42f7a6d135b | Triage

Resubmissions

10-06-2024 21:32

240610-1drlvasajl 10

23-04-2021 16:42

210423-hge38eda1j 8

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 21:32

Sharing

Report Analysis Logs

General

Target

vcruntime140.dll
Size

74KB
MD5

5f9d90d666620944943b0d6d1cca1945
SHA1

08ead2b72a4701349430d18d4a06d9343f777fa6
SHA256

9ec4afad505e0a3dad760fa5b59c66606ae54dd043c16914cf56d7006e46d375
SHA512

be7a2c9dae85e425a280af552dbd7efd84373f780fa8472bab9a5ff29376c3a82d9dfa1fef32c6cf7f45ba6e389de90e090cb579eebff12dcfe12e6f3e7764d1
SSDEEP

1536:TpIhq3RcCBwca4EZEXNciFk+ikPC+ecbiLgavG:TpIY3RcCKcajodF4+ecbiLI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
388	3528	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 3528	1428	rundll32.exe	84
PID 1428 wrote to memory of 3528	1428	rundll32.exe	84
PID 1428 wrote to memory of 3528	1428	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#1
  2⤵
  PID:3528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 604
    3⤵
    - Program crash
    PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3528 -ip 3528
1⤵
PID:2828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads