cbe8bec689fc989f522ce95716bc7eacc85cfba7117b348c257130fab6fef317 | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 08:04

Sharing

Report Analysis Logs

General

Target

$SYSDIR/msvcp60.dll
Size

392KB
MD5

1f767f0303599dd611d24fce6945d2fb
SHA1

986f221ef049f7663c30297b89d67640b86e7ef5
SHA256

17cd3cf219a6fcee30e00055657fcb2b862d2c1405bb6dacdad6627d8a820519
SHA512

96f7a2fcf0e556daf76181772a6f5830edbbaaf534e3c9bc944e14d0c566a3fe486d457b51d70e8fb2c975051e4b02d803642e1752c10ea293ce0ff265bb0ee7
SSDEEP

6144:SVdKp4Ks0V8UwnIpNolC7R48q3OoxHkCTZDs5ln:Yc4KdV8UTNoMR48q3OoxHkCFG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2856	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2856	1560	rundll32.exe	85
PID 1560 wrote to memory of 2856	1560	rundll32.exe	85
PID 1560 wrote to memory of 2856	1560	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\msvcp60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\msvcp60.dll,#1
  2⤵
  PID:2856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 600
    3⤵
    - Program crash
    PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2856 -ip 2856
1⤵
PID:4480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads