a86d97fe008bfeb8568930bfa03e0057f77b0c8a46048ff011af244bfcefee59 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24-07-2024 06:57

Sharing

Report Analysis Logs

General

Target

vcruntime140_1.dll
Size

49KB
MD5

c106bef63b8db2f32de277b0c314249f
SHA1

b172b5809f95bd4f4181fe30c30368b50a27f08a
SHA256

dced523e24b4374522c86f7bbfc0ac8d8e1078336492629722081339adaad9ba
SHA512

77aab947ffec187f054c68899f2b4186a53b2901fb74ee6702586c1207a4abea238c64da0aa3ebe56695c31606b315f9a6289ca1748e9770fcfca5816e7e6580
SSDEEP

768:+Cm5yhUcwrHY/ntTxT6ovF7IVwwIl9znKxnVbgvqxNJUoK/Y/+b:lOHc16opIVwwI3znKxnKvKNJUoK/x

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2892 wrote to memory of 2940	2892	rundll32.exe	WerFault.exe
PID 2892 wrote to memory of 2940	2892	rundll32.exe	WerFault.exe
PID 2892 wrote to memory of 2940	2892	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2892 -s 80
2⤵
PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads