cfd8048f1244c8a839a6ecae5d014013d15e4efe1a387869889a2e2def82a3af

Resubmissions

19-09-2024 07:29

19-09-2024 07:27

19-09-2024 07:21

19-09-2024 07:04

19-09-2024 07:04

19-09-2024 07:00

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 07:00

Target

internationalPaymentDetails/vcruntime140.dll
Size

107KB
MD5

146eb6b29080a212b646289808ae0818
SHA1

e5d9801f226ecd3af662df225f751ae8a8934357
SHA256

f66c606d2ee6bbca375ab4268b0c6aef5170a4ca580a00e17a56057a7a127743
SHA512

0824b42ca2539709f77134ffea9c10fc9f4c126b6a309bd5d3ddd02a660ef98d63b178219d83b173340798c479a1008c2d4f57830898673043fee2450a210a58
SSDEEP

3072:y67mylIhkoQpdK9H9YOecbKV02pKuKLK/M:7iylZoQwH93ecbKCR72/M

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2788	2736	rundll32.exe	30
PID 2736 wrote to memory of 2788	2736	rundll32.exe	30
PID 2736 wrote to memory of 2788	2736	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\internationalPaymentDetails\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2736 -s 80
  2⤵
  PID:2788