cbe8bec689fc989f522ce95716bc7eacc85cfba7117b348c257130fab6fef317 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 08:04

Sharing

Report Analysis Logs

General

Target

$SYSDIR/msvcp60.dll
Size

392KB
MD5

1f767f0303599dd611d24fce6945d2fb
SHA1

986f221ef049f7663c30297b89d67640b86e7ef5
SHA256

17cd3cf219a6fcee30e00055657fcb2b862d2c1405bb6dacdad6627d8a820519
SHA512

96f7a2fcf0e556daf76181772a6f5830edbbaaf534e3c9bc944e14d0c566a3fe486d457b51d70e8fb2c975051e4b02d803642e1752c10ea293ce0ff265bb0ee7
SSDEEP

6144:SVdKp4Ks0V8UwnIpNolC7R48q3OoxHkCTZDs5ln:Yc4KdV8UTNoMR48q3OoxHkCFG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1844	1876	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1876	3036	rundll32.exe	31
PID 3036 wrote to memory of 1876	3036	rundll32.exe	31
PID 3036 wrote to memory of 1876	3036	rundll32.exe	31
PID 3036 wrote to memory of 1876	3036	rundll32.exe	31
PID 3036 wrote to memory of 1876	3036	rundll32.exe	31
PID 3036 wrote to memory of 1876	3036	rundll32.exe	31
PID 3036 wrote to memory of 1876	3036	rundll32.exe	31
PID 1876 wrote to memory of 1844	1876	rundll32.exe	32
PID 1876 wrote to memory of 1844	1876	rundll32.exe	32
PID 1876 wrote to memory of 1844	1876	rundll32.exe	32
PID 1876 wrote to memory of 1844	1876	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\msvcp60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\msvcp60.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 224
    3⤵
    - Program crash
    PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads