6baa51da775f898b0cd03372be44ea4aa4355ac31c473d92f718b189c2e7b3f5

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 09:38

Target

x86/msvcr100d.dll
Size

1.4MB
MD5

b245bf00ba8c1196dbf8c2bd5dec9f60
SHA1

3090b2365ef1c3dbb378d309ee4b9aa811548e07
SHA256

80e8c0147f9960c8982092a4b43329835dc394036306bdd1a763bb59eb3d751b
SHA512

45b453c117fe3ae541eb9af0f8c7fff12dba4c83c95b6ab53027ba5650e44483738cbac34b2847b5830697c66d537dcbc54e76c0235ce7bfa3f9aacdfce685a3
SSDEEP

24576:7m/wTbJniLOB8QyruNelIQrTLGA1IZxvW6q9yNxsjcLO++yR6lPUoLpmLy4fAh:718QyruNwrXGAujvn84qcOvv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2248	2812	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2812	2452	rundll32.exe	29
PID 2452 wrote to memory of 2812	2452	rundll32.exe	29
PID 2452 wrote to memory of 2812	2452	rundll32.exe	29
PID 2452 wrote to memory of 2812	2452	rundll32.exe	29
PID 2452 wrote to memory of 2812	2452	rundll32.exe	29
PID 2452 wrote to memory of 2812	2452	rundll32.exe	29
PID 2452 wrote to memory of 2812	2452	rundll32.exe	29
PID 2812 wrote to memory of 2248	2812	rundll32.exe	30
PID 2812 wrote to memory of 2248	2812	rundll32.exe	30
PID 2812 wrote to memory of 2248	2812	rundll32.exe	30
PID 2812 wrote to memory of 2248	2812	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\msvcr100d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\msvcr100d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 224
    3⤵
    - Program crash
    PID:2248