1a060d1dabd86e25cb6aab039a0fdccd176cb033e5c7823164b97b9284e34191 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 21:56

Sharing

Report Analysis Logs

General

Target

msvcp80.dll
Size

536KB
MD5

4c8a880eabc0b4d462cc4b2472116ea1
SHA1

d0a27f553c0fe0e507c7df079485b601d5b592e6
SHA256

2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08
SHA512

6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c
SSDEEP

12288:Q1HyurvZ0JPjuTtSu86th1n/hUgiW6QR7t5j3Ooc8NHkC2eo:Q1HyurvZ0liTwuhtjnj3Ooc8NHkC2eo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4636 wrote to memory of 3796	4636	rundll32.exe	rundll32.exe
PID 4636 wrote to memory of 3796	4636	rundll32.exe	rundll32.exe
PID 4636 wrote to memory of 3796	4636	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4636

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp80.dll,#1
2⤵
PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads