afa6e7bd9987f1ad9ee381fa067136304d7dae66f2468109aba9d50e2af712e5

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-06-2024 22:29

Target

vvmsvcp140.dll
Size

576KB
MD5

a11a1d761d757d367146f0f772632d8c
SHA1

9fd3eee4c4111dc386510a930192d56a2e938dfe
SHA256

2cc02c5e6654aa9175d5963f811cac222f4a2604dc28553139c675b1a78995a7
SHA512

6fbbb77766ee9846d6d3bde2ced5eeaafe721de5524a410a4821dfa6c08edbd00905bec2b9237b8f7986d6d06dbe444c5845130193da537cadaf29ea784c48e1
SSDEEP

12288:fFrCZUcfGI/O+bE9krdFFM5lle0dkM4X2n08ukSIAg6wQEKZm+jWodEEVrR+:9rCZUNYX2nSkGg6wQEKZm+jWodEE9R+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2924	2864	rundll32.exe	28
PID 2864 wrote to memory of 2924	2864	rundll32.exe	28
PID 2864 wrote to memory of 2924	2864	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vvmsvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2864 -s 80
  2⤵
  PID:2924