b7642a6b4604a036661c77e129d89794023dcab97b3f77a73dbad356fe61d9ad

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 13:07

Target

msvcp140.dll
Size

576KB
MD5

a11a1d761d757d367146f0f772632d8c
SHA1

9fd3eee4c4111dc386510a930192d56a2e938dfe
SHA256

2cc02c5e6654aa9175d5963f811cac222f4a2604dc28553139c675b1a78995a7
SHA512

6fbbb77766ee9846d6d3bde2ced5eeaafe721de5524a410a4821dfa6c08edbd00905bec2b9237b8f7986d6d06dbe444c5845130193da537cadaf29ea784c48e1
SSDEEP

12288:fFrCZUcfGI/O+bE9krdFFM5lle0dkM4X2n08ukSIAg6wQEKZm+jWodEEVrR+:9rCZUNYX2nSkGg6wQEKZm+jWodEE9R+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 3000	2764	rundll32.exe	28
PID 2764 wrote to memory of 3000	2764	rundll32.exe	28
PID 2764 wrote to memory of 3000	2764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2764 -s 84
  2⤵
  PID:3000