8eb6945907c07f04bcfd3d70dde85c2c6adafad1f5a11008df67882a5220f767

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 09:43

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/msvcp140.dll
Size

558KB
MD5

85cbf842a5ae09287fcd243491dd8007
SHA1

b897c3ac1a8d0db1b774ea9495ded805c7900317
SHA256

bf15eb3503876a04d18f9c2bda8ed795012940d387943189f8eea43cdeb78ec4
SHA512

939ea7c9a0f7ca4c9fcf0dfd3f9b1aa972bf2b1cfdf1aff417da1c60c15381db66a09fc76e9aac4a079d0801584edd46cd08e319305822b986c4db5bbc12e6ac
SSDEEP

12288:y/Wn7JnU0QUgqtLe1fqSKnqEXG6IOaaal7wC/QaDWxncycIW6zuyLQEKZm+jWody:0N59IW6zuAQEKZm+jWodEEYt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2240	2160	rundll32.exe	28
PID 2160 wrote to memory of 2240	2160	rundll32.exe	28
PID 2160 wrote to memory of 2240	2160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2160 -s 80
  2⤵
  PID:2240