442c5e4c8e56bf5fb453fa70d9afefac6d8aad0d861db57055ad4e8bbe31535f | Triage

Analysis

max time kernel
11s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 11:05

Sharing

Report Analysis Logs

General

Target

vcruntime140.dll
Size

107KB
MD5

146eb6b29080a212b646289808ae0818
SHA1

e5d9801f226ecd3af662df225f751ae8a8934357
SHA256

f66c606d2ee6bbca375ab4268b0c6aef5170a4ca580a00e17a56057a7a127743
SHA512

0824b42ca2539709f77134ffea9c10fc9f4c126b6a309bd5d3ddd02a660ef98d63b178219d83b173340798c479a1008c2d4f57830898673043fee2450a210a58
SSDEEP

3072:y67mylIhkoQpdK9H9YOecbKV02pKuKLK/M:7iylZoQwH93ecbKCR72/M

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2740	2876	rundll32.exe	30
PID 2876 wrote to memory of 2740	2876	rundll32.exe	30
PID 2876 wrote to memory of 2740	2876	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2876 -s 84
  2⤵
  PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads