914401789c623bbfc608ce1574838a7e3e39fbbbe24c34c15483f67200942c9b

Analysis

max time kernel
1563s
max time network
1565s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 20:39

Target

I386/MSVCRT.dll
Size

288KB
MD5

055b02d711cdedb8c5997274c4e99cb8
SHA1

5c816eeb6e4d5f1c11e9f56c992ee7d452e7c0f9
SHA256

d7cea69a98579d928e534070f5293e80ed7df38baf611b20717ef55aa1344a18
SHA512

4774431fe768e424f46c833236a41d68f05d98ed14353b04428a5d190dbe213bb56087a5e5cca5cd98598f2c1611fddfed3a7a79bbd362bc02e586cc367907c0
SSDEEP

6144:yk54RkH8RKDou3LlG/3Roe0Ro4zJsdF9gjFMgiFjNr7mcl2oZhogKLOmJxZR92l3:R4RtIR3BG/3We0RVJsdFFUzchogKLOmc

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2812 2968 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2812	2968	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2972 wrote to memory of 2968	2972	rundll32.exe	rundll32.exe
PID 2972 wrote to memory of 2968	2972	rundll32.exe	rundll32.exe
PID 2972 wrote to memory of 2968	2972	rundll32.exe	rundll32.exe
PID 2972 wrote to memory of 2968	2972	rundll32.exe	rundll32.exe
PID 2972 wrote to memory of 2968	2972	rundll32.exe	rundll32.exe
PID 2972 wrote to memory of 2968	2972	rundll32.exe	rundll32.exe
PID 2972 wrote to memory of 2968	2972	rundll32.exe	rundll32.exe
PID 2968 wrote to memory of 2812	2968	rundll32.exe	WerFault.exe
PID 2968 wrote to memory of 2812	2968	rundll32.exe	WerFault.exe
PID 2968 wrote to memory of 2812	2968	rundll32.exe	WerFault.exe
PID 2968 wrote to memory of 2812	2968	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\MSVCRT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\MSVCRT.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 224
    3⤵
    - Program crash
    PID:2812