6cd928dbb06199acd086e5cd97c06ce8df59f3e1f6a4e0e021f5a9899c28c6a9 | Triage

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:14

Sharing

Report Analysis Logs

General

Target

syssetup/vcamp140.dll
Size

396KB
MD5

e02baf8cf42baa9c39ddec9a6d573a2e
SHA1

7a43c3f407593a842cec29ec42a02ddcfa69c3c9
SHA256

1b02cdf81bda25b73d21eb38fa56c4c3330b86399fdd3385078312200a44f3cc
SHA512

63ade867874c7ce1eacd40084190ac87438433602fdad3eeeac6fcb57e43caa01d40a878036cdae858fa162cc40df006a1ebaa11f3461cee70b95ccb0c940f15
SSDEEP

12288:gn8TPix8G11laDuCwWDwvEX689X6dw1CBvB:gn8TPI11laDuCwWDwvEX6M6g0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 2716	560	rundll32.exe	29
PID 560 wrote to memory of 2716	560	rundll32.exe	29
PID 560 wrote to memory of 2716	560	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\syssetup\vcamp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 560 -s 96
  2⤵
  PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads