8bee452d2535953e7ad9d18fffacbef60560fc05647c735ef55393c0869b673d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 01:32

Target
files/vcruntime140.dll
Size 81KB
Sample240620-byeeks1enh
SHA256 346f72c9a7584c2ab6ce65cd38a616c77ebddc0bbab2274c4e89dd5e62237517
MD5 16b26bc43943531d7d7e379632ed4e63
SHA1 565287de39649e59e653a3612478c2186096d70a
SHA512 b5b7b4b8c5ab4276a34956e43f586272b1803ec3609253fee1bcc0a549aed7ba11d47404b023f7b67af701726bab95cca55738e7bd5bca272eca5ac71bb418cc
SSDEEP 1536:BDpX0WKXQn6s8/oB6xMSKgS9WnESDPIYMWC/q6mYIeTsu03/huecbFWzZoi:BF0ZQnm/oBab8y6mfe0vhuecbFWzZoi
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	2460	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2460	2644	rundll32.exe	28
PID 2644 wrote to memory of 2460	2644	rundll32.exe	28
PID 2644 wrote to memory of 2460	2644	rundll32.exe	28
PID 2644 wrote to memory of 2460	2644	rundll32.exe	28
PID 2644 wrote to memory of 2460	2644	rundll32.exe	28
PID 2644 wrote to memory of 2460	2644	rundll32.exe	28
PID 2644 wrote to memory of 2460	2644	rundll32.exe	28
PID 2460 wrote to memory of 2864	2460	rundll32.exe	29
PID 2460 wrote to memory of 2864	2460	rundll32.exe	29
PID 2460 wrote to memory of 2864	2460	rundll32.exe	29
PID 2460 wrote to memory of 2864	2460	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\vcruntime140.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 220
    3⤵
    - Program crash
    PID:2864