99e3a0d588ff5bf3d77151194176c2c558219aa1453ff74b1df00b8e6c1ae70d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-10-2024 00:31

Target

RRN V2/_internal/VCRUNTIME140.dll
Size

116KB
MD5

be8dbe2dc77ebe7f88f910c61aec691a
SHA1

a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256

4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512

0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP

1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2376 wrote to memory of 2244	2376	rundll32.exe	31
PID 2376 wrote to memory of 2244	2376	rundll32.exe	31
PID 2376 wrote to memory of 2244	2376	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\RRN V2\_internal\VCRUNTIME140.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2376 -s 80
  2⤵
  PID:2244