4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 10:27

Target

VCRUNTIME140.dll
Size

116KB
MD5

be8dbe2dc77ebe7f88f910c61aec691a
SHA1

a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256

4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512

0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP

1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2968	2228	rundll32.exe	29
PID 2228 wrote to memory of 2968	2228	rundll32.exe	29
PID 2228 wrote to memory of 2968	2228	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VCRUNTIME140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2228 -s 80
  2⤵
  PID:2968