6baa51da775f898b0cd03372be44ea4aa4355ac31c473d92f718b189c2e7b3f5 | Triage

Analysis

max time kernel
17s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 09:38

Sharing

Report Analysis Logs

General

Target

x64/msvcr100.dll
Size

808KB
MD5

aed6d63cfa5a3ef7021af9c457fee994
SHA1

f6ad746ef520b03df6cf0f5a2512d0df964c4688
SHA256

b4bfa27f677295b00a1df9a7e14db4b75cac2dd41b898d4e9a378eccce3699f0
SHA512

5573b17eb19d13cc96df5d66ef60cc8ff98e1ac9d8582a870ed2befa28ee271fb41741a92aa703234150fceadf4a436d10b8a6518c1816d0c804eb1261650d2d
SSDEEP

24576:C5e4L1vwTowTWqwVeeK7R/myyKgn9IrzOI:C5e4LfUWqAacn9Y

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2504	1068	rundll32.exe	29
PID 1068 wrote to memory of 2504	1068	rundll32.exe	29
PID 1068 wrote to memory of 2504	1068	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\msvcr100.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1068 -s 80
  2⤵
  PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads