6d7a257e34261f8c88e355658881a50a056f8600e2e57ac0b24647a35143e1d2

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 01:35

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/vcruntime140_1.dll
Size

42KB
MD5

eccb03a6e0065535ec3b26ed393e262f
SHA1

14a39c0f41332f159a7ea363b420109366aa44ef
SHA256

a76ae57922bfde0dbfb6d7923c75ea8c8c8c6d4d5d09189ad574c98a8ada855a
SHA512

92312b7a244fd2da3d165ba8c33b907882ad9f1a1383d07f9054dc47d430d38b11f35640e9f8be1ad86fe7a67b5f6d5a1b10c6414a4d060c29338f30ae29c668
SSDEEP

768:+Cm5KhUcwrHY/ntTxT6ov07baYi+Yi3BhUAMxkETh:lmHc16oeba7+7nyxfh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2116	2496	rundll32.exe	30
PID 2496 wrote to memory of 2116	2496	rundll32.exe	30
PID 2496 wrote to memory of 2116	2496	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\vcruntime140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2496 -s 80
  2⤵
  PID:2116