6877fc96e12967e2edd83747fed16a9fefde37bd0ee69616d9b9226e9bf93f33 | Triage

Analysis

max time kernel
11s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 18:39

Sharing

Report Analysis Logs

General

Target

user32/msvcr120_clr0400.dll
Size

970KB
MD5

99e982747b36af703209b734d9d05263
SHA1

c889d6646d7c33fb108e2719875c5f4c49a6b0c0
SHA256

17e09579c756d7374dea79969bab36d3d9257d4d51aa1934d2db1be374d9a425
SHA512

0320201088fbea857745c25512c7840dfd375f56a4bd881cd3910de7e7aee58309f84450796d098bb4754b6ba6ea1409ec58c4e44c264384459be077f2bf6a9b
SSDEEP

24576:JZW0xZ/BOwDlQcUHGOdrOhO+LwRZkUTotQmWym5/:JJKKs/d2O+0IUEk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2416	2452	rundll32.exe	29
PID 2452 wrote to memory of 2416	2452	rundll32.exe	29
PID 2452 wrote to memory of 2416	2452	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\user32\msvcr120_clr0400.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2452 -s 84
  2⤵
  PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads