8be410717226b5e873c61a30d92a767c6c6492ce6358cd79b2a41cb23dba05cd | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 09:31

Sharing

Report Analysis Logs

General

Target

$SYSDIR/msvcrt.dll
Size

280KB
MD5

dc8b7481f2239317aac1d1ad5498030d
SHA1

5ae6cd3efb3a4ffdeaec52099a96f1bade107978
SHA256

0a38f3f641dda8f39d5a9e07cc2a09cca3d8e08f7d119d37a88bf1aa9602add3
SHA512

0702402bcb4c23a63bd781c412c11fda7643f23bc3f744eda733fa66af8f82ea57f732bd18b54e3954f5b053a3af8a554d975e818009747441089cd6a3692344
SSDEEP

6144:/zZ1SdxAjXExZf/6qxXkj8eWNB4ctFMgiFwNr7mcl2+LZdV:rZ1k2DExZqis8eg4GUzoL

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	2336	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2336	2780	rundll32.exe	30
PID 2780 wrote to memory of 2336	2780	rundll32.exe	30
PID 2780 wrote to memory of 2336	2780	rundll32.exe	30
PID 2780 wrote to memory of 2336	2780	rundll32.exe	30
PID 2780 wrote to memory of 2336	2780	rundll32.exe	30
PID 2780 wrote to memory of 2336	2780	rundll32.exe	30
PID 2780 wrote to memory of 2336	2780	rundll32.exe	30
PID 2336 wrote to memory of 3004	2336	rundll32.exe	31
PID 2336 wrote to memory of 3004	2336	rundll32.exe	31
PID 2336 wrote to memory of 3004	2336	rundll32.exe	31
PID 2336 wrote to memory of 3004	2336	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\msvcrt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\msvcrt.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 224
    3⤵
    - Program crash
    PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads