9b9016b5402fd2bba74ca80fbd4c1fd33424276a5d909bfd6d3e88246276bc9f | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 14:53

Sharing

Report Analysis Logs

General

Target

vcruntime140_1.dll
Size

37KB
MD5

75e78e4bf561031d39f86143753400ff
SHA1

324c2a99e39f8992459495182677e91656a05206
SHA256

1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
SHA512

ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756
SSDEEP

768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2000	1252	rundll32.exe	28
PID 1252 wrote to memory of 2000	1252	rundll32.exe	28
PID 1252 wrote to memory of 2000	1252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1252 -s 80
  2⤵
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads