e8208b4ea0372e7708d867c4df307677ed6af1d1a10d87f1b2a8e02bd184b71f | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 00:48

Sharing

Report Analysis Logs

General

Target

A FINAL DRAFT BL 00595854/vcruntime140.dll
Size

107KB
MD5

146eb6b29080a212b646289808ae0818
SHA1

e5d9801f226ecd3af662df225f751ae8a8934357
SHA256

f66c606d2ee6bbca375ab4268b0c6aef5170a4ca580a00e17a56057a7a127743
SHA512

0824b42ca2539709f77134ffea9c10fc9f4c126b6a309bd5d3ddd02a660ef98d63b178219d83b173340798c479a1008c2d4f57830898673043fee2450a210a58
SSDEEP

3072:y67mylIhkoQpdK9H9YOecbKV02pKuKLK/M:7iylZoQwH93ecbKCR72/M

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1952	2380	rundll32.exe	30
PID 2380 wrote to memory of 1952	2380	rundll32.exe	30
PID 2380 wrote to memory of 1952	2380	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\A FINAL DRAFT BL 00595854\vcruntime140.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2380 -s 80
  2⤵
  PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads