cfd8048f1244c8a839a6ecae5d014013d15e4efe1a387869889a2e2def82a3af

Resubmissions

19-09-2024 07:29

19-09-2024 07:27

19-09-2024 07:21

19-09-2024 07:04

19-09-2024 07:04

19-09-2024 07:00

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 07:00

Target

internationalPaymentDetails/msvcp140.dll
Size

565KB
MD5

cf3c9952962640598e669f48c5c5480d
SHA1

b373762c86a3eeffe73d0434c0d2c2abd2815e70
SHA256

053ca8ee2206b4639efbcbfd068df741b6ef5b49f19c0e2afb4e63b687e4aff1
SHA512

28126446c66ede4a3d33d9345dfd7ccaaf4306fe038fb13bbafabc389339ce5bac9b862283d6464622d5cf625c313b77c201a5beda460067f87819ad06fd1753
SSDEEP

12288:67dqZ1EqSGQEwkcz6sm7UtgZ/29z7mnuMG7NaekWdgJMKZ+h7rUh0wvaQEKZm+jv:6ZNg+h7r6iQEKZm+jWodEERAc7GK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2656	2088	rundll32.exe	30
PID 2088 wrote to memory of 2656	2088	rundll32.exe	30
PID 2088 wrote to memory of 2656	2088	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\internationalPaymentDetails\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2088 -s 80
  2⤵
  PID:2656