ee800a6102a9c87635e9f06dbc899653842ee9adec96e61d4355947639ae1602 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
18-06-2024 19:24

Sharing

Report Analysis Logs

General

Target

file/concrt140.dll
Size

309KB
MD5

31f210ed5c6f2d8faa1d896cda18584b
SHA1

5444d919f5014fb6bf58cefc6f01088c32a24a00
SHA256

5393f592cded7bd8ae07b2afc3efdcc4a0b05f7e8e74380a267398266fc02d41
SHA512

d39aa7acfd982759825b537a9ca5b04e6cdd9c0a28089e0f666ae4b75e84e2e2e58180103da38bea79efe3252cb9f1932efa69b64461cb76173645e8b6ddf3f6
SSDEEP

6144:Ylm+bq4hSdOec4xWMXdtvo4KbrniIzb7wQjnWzgCE33g:pmP/eJXzvSCzW3g

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2052	2804	rundll32.exe	28
PID 2804 wrote to memory of 2052	2804	rundll32.exe	28
PID 2804 wrote to memory of 2052	2804	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file\concrt140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2804 -s 80
  2⤵
  PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads