a86d97fe008bfeb8568930bfa03e0057f77b0c8a46048ff011af244bfcefee59 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-07-2024 06:57

Sharing

Report Analysis Logs

General

Target

vcruntime140.dll
Size

107KB
MD5

146eb6b29080a212b646289808ae0818
SHA1

e5d9801f226ecd3af662df225f751ae8a8934357
SHA256

f66c606d2ee6bbca375ab4268b0c6aef5170a4ca580a00e17a56057a7a127743
SHA512

0824b42ca2539709f77134ffea9c10fc9f4c126b6a309bd5d3ddd02a660ef98d63b178219d83b173340798c479a1008c2d4f57830898673043fee2450a210a58
SSDEEP

3072:y67mylIhkoQpdK9H9YOecbKV02pKuKLK/M:7iylZoQwH93ecbKCR72/M

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2912 wrote to memory of 2452	2912	rundll32.exe	WerFault.exe
PID 2912 wrote to memory of 2452	2912	rundll32.exe	WerFault.exe
PID 2912 wrote to memory of 2452	2912	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2912 -s 80
2⤵
PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads