8eb6945907c07f04bcfd3d70dde85c2c6adafad1f5a11008df67882a5220f767

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 09:43

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/vcruntime140.dll
Size

100KB
MD5

a1cae131e18ffd5037b98617708ebd78
SHA1

906de2dd02aff9dfff38635d2752013b297726ce
SHA256

18097cfe4c9ab8d5268b2257e9728cd147d0c075473d0585bdbf482d88810c33
SHA512

608a1c7dde8f8e7fc046dfda7e8581b2281871c98c2ed367f0aa83f864f668b6a8924abca8b6c8ec938f1d9937ed811e416c00bdc90e571e8dd80af9fd276152
SSDEEP

1536:yqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNY7g7RNxh:yqrfZ+jPYNzoHA4decbK/FNYcV1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2404	2500	rundll32.exe	30
PID 2500 wrote to memory of 2404	2500	rundll32.exe	30
PID 2500 wrote to memory of 2404	2500	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2500 -s 80
  2⤵
  PID:2404