ee800a6102a9c87635e9f06dbc899653842ee9adec96e61d4355947639ae1602

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-06-2024 19:24

Target

file/vvmsvcp140.dll
Size

576KB
MD5

a11a1d761d757d367146f0f772632d8c
SHA1

9fd3eee4c4111dc386510a930192d56a2e938dfe
SHA256

2cc02c5e6654aa9175d5963f811cac222f4a2604dc28553139c675b1a78995a7
SHA512

6fbbb77766ee9846d6d3bde2ced5eeaafe721de5524a410a4821dfa6c08edbd00905bec2b9237b8f7986d6d06dbe444c5845130193da537cadaf29ea784c48e1
SSDEEP

12288:fFrCZUcfGI/O+bE9krdFFM5lle0dkM4X2n08ukSIAg6wQEKZm+jWodEEVrR+:9rCZUNYX2nSkGg6wQEKZm+jWodEE9R+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1840	2276	rundll32.exe	28
PID 2276 wrote to memory of 1840	2276	rundll32.exe	28
PID 2276 wrote to memory of 1840	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file\vvmsvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2276 -s 80
  2⤵
  PID:1840