fd7ca23ec24b74e3bf0d1d54be67e6bd97987affa40014c43ea07191318866d8

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 01:35

Target

safe-archive/msvcp140.dll
Size

576KB
MD5

a11a1d761d757d367146f0f772632d8c
SHA1

9fd3eee4c4111dc386510a930192d56a2e938dfe
SHA256

2cc02c5e6654aa9175d5963f811cac222f4a2604dc28553139c675b1a78995a7
SHA512

6fbbb77766ee9846d6d3bde2ced5eeaafe721de5524a410a4821dfa6c08edbd00905bec2b9237b8f7986d6d06dbe444c5845130193da537cadaf29ea784c48e1
SSDEEP

12288:fFrCZUcfGI/O+bE9krdFFM5lle0dkM4X2n08ukSIAg6wQEKZm+jWodEEVrR+:9rCZUNYX2nSkGg6wQEKZm+jWodEE9R+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3048 wrote to memory of 2336	3048	rundll32.exe	WerFault.exe
PID 3048 wrote to memory of 2336	3048	rundll32.exe	WerFault.exe
PID 3048 wrote to memory of 2336	3048	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\safe-archive\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3048 -s 80
  2⤵
  PID:2336