fd7ca23ec24b74e3bf0d1d54be67e6bd97987affa40014c43ea07191318866d8 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 14:41

Sharing

Report Analysis Logs

General

Target

safe-archive/concrt140.dll
Size

309KB
MD5

31f210ed5c6f2d8faa1d896cda18584b
SHA1

5444d919f5014fb6bf58cefc6f01088c32a24a00
SHA256

5393f592cded7bd8ae07b2afc3efdcc4a0b05f7e8e74380a267398266fc02d41
SHA512

d39aa7acfd982759825b537a9ca5b04e6cdd9c0a28089e0f666ae4b75e84e2e2e58180103da38bea79efe3252cb9f1932efa69b64461cb76173645e8b6ddf3f6
SSDEEP

6144:Ylm+bq4hSdOec4xWMXdtvo4KbrniIzb7wQjnWzgCE33g:pmP/eJXzvSCzW3g

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2028 wrote to memory of 2036	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 2036	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 2036	2028	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\safe-archive\concrt140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2028 -s 80
  2⤵
  PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads