442c5e4c8e56bf5fb453fa70d9afefac6d8aad0d861db57055ad4e8bbe31535f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 07:14

Target

msvcp140.dll
Size

565KB
MD5

cf3c9952962640598e669f48c5c5480d
SHA1

b373762c86a3eeffe73d0434c0d2c2abd2815e70
SHA256

053ca8ee2206b4639efbcbfd068df741b6ef5b49f19c0e2afb4e63b687e4aff1
SHA512

28126446c66ede4a3d33d9345dfd7ccaaf4306fe038fb13bbafabc389339ce5bac9b862283d6464622d5cf625c313b77c201a5beda460067f87819ad06fd1753
SSDEEP

12288:67dqZ1EqSGQEwkcz6sm7UtgZ/29z7mnuMG7NaekWdgJMKZ+h7rUh0wvaQEKZm+jv:6ZNg+h7r6iQEKZm+jWodEERAc7GK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2112	2828	rundll32.exe	28
PID 2828 wrote to memory of 2112	2828	rundll32.exe	28
PID 2828 wrote to memory of 2112	2828	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2828 -s 80
  2⤵
  PID:2112