e8208b4ea0372e7708d867c4df307677ed6af1d1a10d87f1b2a8e02bd184b71f

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 00:48

Target

A FINAL DRAFT BL 00595854/vcruntime140_1.dll
Size

49KB
MD5

c106bef63b8db2f32de277b0c314249f
SHA1

b172b5809f95bd4f4181fe30c30368b50a27f08a
SHA256

dced523e24b4374522c86f7bbfc0ac8d8e1078336492629722081339adaad9ba
SHA512

77aab947ffec187f054c68899f2b4186a53b2901fb74ee6702586c1207a4abea238c64da0aa3ebe56695c31606b315f9a6289ca1748e9770fcfca5816e7e6580
SSDEEP

768:+Cm5yhUcwrHY/ntTxT6ovF7IVwwIl9znKxnVbgvqxNJUoK/Y/+b:lOHc16opIVwwI3znKxnKvKNJUoK/x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 764	2872	rundll32.exe	28
PID 2872 wrote to memory of 764	2872	rundll32.exe	28
PID 2872 wrote to memory of 764	2872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\A FINAL DRAFT BL 00595854\vcruntime140_1.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2872 -s 80
  2⤵
  PID:764