6baa51da775f898b0cd03372be44ea4aa4355ac31c473d92f718b189c2e7b3f5 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 09:38

Sharing

Report Analysis Logs

General

Target

x64/msvcr100d.dll
Size

1.8MB
MD5

acb4573209fc9f335e242017c3064e5c
SHA1

e6e658ae0bddc6dea759d716e1bedaf679d44c81
SHA256

c9fff0b1022356e563929ccdc89936f6a2c0e39a5550c3d12e3d08cd784013e6
SHA512

97a5d4e5c9be45f99a6e2fc892055c1659522d2d6306c0a175c566fb6b969c7cdab23bb07c3c196ca7e3bddd0d286ea51317e1403b4db037bbb75b44b75ac123
SSDEEP

24576:12e5e7DKWXkG3fAXBTZsjMPv1sAalamNyBe/4zSU:xLWvYXscsAalk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2264	3032	rundll32.exe	30
PID 3032 wrote to memory of 2264	3032	rundll32.exe	30
PID 3032 wrote to memory of 2264	3032	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\msvcr100d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3032 -s 80
  2⤵
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads