79d7036b030dcaaec258637b01dbc4f9786d6777afe85f6fe397d6034e2f4806 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 17:55

Sharing

Report Analysis Logs

General

Target

vcruntime140.dll
Size

94KB
MD5

5797d2a762227f35cdd581ec648693a8
SHA1

e587b804db5e95833cbd2229af54c755ee0393b9
SHA256

c51c64dfb7c445ecf0001f69c27e13299ddcfba0780efa72b866a7487b7491c7
SHA512

5c4de4f65c0338f9a63b853db356175cae15c2ddc6b727f473726d69ee0d07545ac64b313c380548211216ea667caf32c5a0fd86f7abe75fc60086822bc4c92e
SSDEEP

1536:yOHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1lLN:yOr/Z+jPYNV9H0Q8ecbjt1j

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2200	3048	rundll32.exe	28
PID 3048 wrote to memory of 2200	3048	rundll32.exe	28
PID 3048 wrote to memory of 2200	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3048 -s 80
  2⤵
  PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads