914401789c623bbfc608ce1574838a7e3e39fbbbe24c34c15483f67200942c9b | Triage

Analysis

max time kernel
1563s
max time network
1571s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 20:39

Sharing

Report Analysis Logs

General

Target

I386/MSVCP50.dll
Size

552KB
MD5

fd31a6a72e5e4af02daababb2b1fd89c
SHA1

2a39ad96361ff86997e038e652cb4c5aed7d553b
SHA256

0fa1a6a704604890fec6a545464ea144e2319b10d4702a4e6aa280193248985f
SHA512

26ff05c179a52366bcdbcac9ab01258de3d4aec9a4286cb3c6265a4d20d0de57a503863a8177a1ab7081ee4499577d8a0d3afd284f6f70d934d3a6fe9725fda6
SSDEEP

12288:gl3kpKgpWFynTJ2VKBrCT8Wbyyj61xz7q3OocHkCP9:5KgpWFynTN9CIWK1l7q3OocHkCP9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2524 1892 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2376 wrote to memory of 1892	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 1892	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 1892	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 1892	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 1892	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 1892	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 1892	2376	rundll32.exe	rundll32.exe
PID 1892 wrote to memory of 2524	1892	rundll32.exe	WerFault.exe
PID 1892 wrote to memory of 2524	1892	rundll32.exe	WerFault.exe
PID 1892 wrote to memory of 2524	1892	rundll32.exe	WerFault.exe
PID 1892 wrote to memory of 2524	1892	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\MSVCP50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\MSVCP50.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 228
    3⤵
    - Program crash
    PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads