8286913b27550033c014364f88fd7b80a506f3a0da12e08224369b798582cbd2

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 15:22

Target

msvcp140.dll
Size

566KB
MD5

c7bd5aa5f047098ef99360853831a83a
SHA1

64f3da3e5610b5133fac3293259668178819b9ae
SHA256

5f4684aff855b8886b9e4745f7d333aeb8d4a208ac1464bb73a7034d1abb40d4
SHA512

345ba6f9d0d8de2eb93afa34504a5be6c1e4f03828d7d9d08f38011d70fadee78bc1adf4fa16e0b49696a1748935ccc559d4f449dc9f136de9218436142b35f1
SSDEEP

12288:2CParwZBMpKD/Xpc7l0HV0oJKD3mmuCo7WJ5QWdH2aSaMPWtQEKZm+jWodEEV2uu:2kEH2lWtQEKZm+jWodEEkl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2196 wrote to memory of 1604	2196	rundll32.exe	WerFault.exe
PID 2196 wrote to memory of 1604	2196	rundll32.exe	WerFault.exe
PID 2196 wrote to memory of 1604	2196	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2196 -s 112
  2⤵
  PID:1604