cfd8048f1244c8a839a6ecae5d014013d15e4efe1a387869889a2e2def82a3af

Resubmissions

19-09-2024 07:29

19-09-2024 07:27

19-09-2024 07:21

19-09-2024 07:04

19-09-2024 07:04

19-09-2024 07:00

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 07:00

Target

internationalPaymentDetails/vcruntime140_1.dll
Size

49KB
MD5

c106bef63b8db2f32de277b0c314249f
SHA1

b172b5809f95bd4f4181fe30c30368b50a27f08a
SHA256

dced523e24b4374522c86f7bbfc0ac8d8e1078336492629722081339adaad9ba
SHA512

77aab947ffec187f054c68899f2b4186a53b2901fb74ee6702586c1207a4abea238c64da0aa3ebe56695c31606b315f9a6289ca1748e9770fcfca5816e7e6580
SSDEEP

768:+Cm5yhUcwrHY/ntTxT6ovF7IVwwIl9znKxnVbgvqxNJUoK/Y/+b:lOHc16opIVwwI3znKxnKvKNJUoK/x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1784	1968	rundll32.exe	30
PID 1968 wrote to memory of 1784	1968	rundll32.exe	30
PID 1968 wrote to memory of 1784	1968	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\internationalPaymentDetails\vcruntime140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1968 -s 80
  2⤵
  PID:1784