a86d97fe008bfeb8568930bfa03e0057f77b0c8a46048ff011af244bfcefee59 | Triage

Resubmissions

29-07-2024 20:42

240729-zhay8atfmb 10

26-07-2024 11:22

240726-ng188sycjb 10

25-07-2024 05:05

240725-fqw2watble 10

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 05:05

Sharing

Report Analysis Logs

General

Target

vcruntime140.dll
Size

107KB
MD5

146eb6b29080a212b646289808ae0818
SHA1

e5d9801f226ecd3af662df225f751ae8a8934357
SHA256

f66c606d2ee6bbca375ab4268b0c6aef5170a4ca580a00e17a56057a7a127743
SHA512

0824b42ca2539709f77134ffea9c10fc9f4c126b6a309bd5d3ddd02a660ef98d63b178219d83b173340798c479a1008c2d4f57830898673043fee2450a210a58
SSDEEP

3072:y67mylIhkoQpdK9H9YOecbKV02pKuKLK/M:7iylZoQwH93ecbKCR72/M

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2104 wrote to memory of 2536	2104	rundll32.exe	WerFault.exe
PID 2104 wrote to memory of 2536	2104	rundll32.exe	WerFault.exe
PID 2104 wrote to memory of 2536	2104	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2104 -s 80
2⤵
PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads