8eb6945907c07f04bcfd3d70dde85c2c6adafad1f5a11008df67882a5220f767

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 09:43

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/vcruntime140_1.dll
Size

42KB
MD5

eccb03a6e0065535ec3b26ed393e262f
SHA1

14a39c0f41332f159a7ea363b420109366aa44ef
SHA256

a76ae57922bfde0dbfb6d7923c75ea8c8c8c6d4d5d09189ad574c98a8ada855a
SHA512

92312b7a244fd2da3d165ba8c33b907882ad9f1a1383d07f9054dc47d430d38b11f35640e9f8be1ad86fe7a67b5f6d5a1b10c6414a4d060c29338f30ae29c668
SSDEEP

768:+Cm5KhUcwrHY/ntTxT6ov07baYi+Yi3BhUAMxkETh:lmHc16oeba7+7nyxfh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1044	1736	rundll32.exe	29
PID 1736 wrote to memory of 1044	1736	rundll32.exe	29
PID 1736 wrote to memory of 1044	1736	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\vcruntime140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1736 -s 80
  2⤵
  PID:1044