356718348bcea435440e1eff66f69846adba5bfcd54c0ef651ddc417fc4b768c

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 06:49

Target
x64__setup__build_18957/msvcp140/msvcp140.dll
Size 554KB
Sample240712-hlmnrasfml
SHA256 9b783a58b3e1cd9976169f3ca9329f868b7980966d34a84274c2208a64f8b6fb
MD5 53a6dd2062e438cfdfc3327cd48e9a43
SHA1 02f7cb32c424d06fab1937ce0203952fe0f558e6
SHA512 d24d58d940e7b77bdd36dfc1b601eed9355f9d9560152196754dbb9c1ce3276646003b23af34274b971b87c39da1681f3b1e6f81721b81c68441a12895cb9825
SSDEEP 12288:D0+cOjCI4JxkdGwm9b39KJ7TgQSToGet+VfTxZ5HU/Z8y8RQEKZm+jWodEEV8q:A+cJjxzH68RQEKZm+jWodEEuq
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2176	2824	rundll32.exe	30
PID 2824 wrote to memory of 2176	2824	rundll32.exe	30
PID 2824 wrote to memory of 2176	2824	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64__setup__build_18957\msvcp140\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2824 -s 80
  2⤵
  PID:2176