a86d97fe008bfeb8568930bfa03e0057f77b0c8a46048ff011af244bfcefee59 | Triage

Resubmissions

29-07-2024 20:42

240729-zhay8atfmb 10

26-07-2024 11:22

240726-ng188sycjb 10

25-07-2024 05:05

240725-fqw2watble 10

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 05:05

Sharing

Report Analysis Logs

General

Target

vcruntime140_1.dll
Size

49KB
MD5

c106bef63b8db2f32de277b0c314249f
SHA1

b172b5809f95bd4f4181fe30c30368b50a27f08a
SHA256

dced523e24b4374522c86f7bbfc0ac8d8e1078336492629722081339adaad9ba
SHA512

77aab947ffec187f054c68899f2b4186a53b2901fb74ee6702586c1207a4abea238c64da0aa3ebe56695c31606b315f9a6289ca1748e9770fcfca5816e7e6580
SSDEEP

768:+Cm5yhUcwrHY/ntTxT6ovF7IVwwIl9znKxnVbgvqxNJUoK/Y/+b:lOHc16opIVwwI3znKxnKvKNJUoK/x

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2308 wrote to memory of 2212	2308	rundll32.exe	WerFault.exe
PID 2308 wrote to memory of 2212	2308	rundll32.exe	WerFault.exe
PID 2308 wrote to memory of 2212	2308	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2308 -s 80
2⤵
PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads