6d7a257e34261f8c88e355658881a50a056f8600e2e57ac0b24647a35143e1d2

Analysis

max time kernel
10s
max time network
25s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 01:35

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/msvcp140.dll
Size

558KB
MD5

85cbf842a5ae09287fcd243491dd8007
SHA1

b897c3ac1a8d0db1b774ea9495ded805c7900317
SHA256

bf15eb3503876a04d18f9c2bda8ed795012940d387943189f8eea43cdeb78ec4
SHA512

939ea7c9a0f7ca4c9fcf0dfd3f9b1aa972bf2b1cfdf1aff417da1c60c15381db66a09fc76e9aac4a079d0801584edd46cd08e319305822b986c4db5bbc12e6ac
SSDEEP

12288:y/Wn7JnU0QUgqtLe1fqSKnqEXG6IOaaal7wC/QaDWxncycIW6zuyLQEKZm+jWody:0N59IW6zuAQEKZm+jWodEEYt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2352	2104	rundll32.exe	29
PID 2104 wrote to memory of 2352	2104	rundll32.exe	29
PID 2104 wrote to memory of 2352	2104	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2104 -s 80
  2⤵
  PID:2352