6d7a257e34261f8c88e355658881a50a056f8600e2e57ac0b24647a35143e1d2

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 01:35

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/vcruntime140.dll
Size

100KB
MD5

a1cae131e18ffd5037b98617708ebd78
SHA1

906de2dd02aff9dfff38635d2752013b297726ce
SHA256

18097cfe4c9ab8d5268b2257e9728cd147d0c075473d0585bdbf482d88810c33
SHA512

608a1c7dde8f8e7fc046dfda7e8581b2281871c98c2ed367f0aa83f864f668b6a8924abca8b6c8ec938f1d9937ed811e416c00bdc90e571e8dd80af9fd276152
SSDEEP

1536:yqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNY7g7RNxh:yqrfZ+jPYNzoHA4decbK/FNYcV1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1644	2184	rundll32.exe	31
PID 2184 wrote to memory of 1644	2184	rundll32.exe	31
PID 2184 wrote to memory of 1644	2184	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2184 -s 80
  2⤵
  PID:1644