8286913b27550033c014364f88fd7b80a506f3a0da12e08224369b798582cbd2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 15:22

Target

msvcp140_codecvt_ids.dll
Size

29KB
MD5

67c6156c10262186565f1e30c5c14bd2
SHA1

c5ac39c473edde393e27f945878872fb7723f2a5
SHA256

42ac3c3a4ebcb1bff0bbb6fe5012662206eaf1794ef5e2abc3cdd78e494daf24
SHA512

2b484f2af802e5a8c76d41f4b3c4b14a2e019e1abc0c26d561e0784f49f6b1196a029be5f6fb5f8b0f607376056d1d0851dbe45d6e1a9ca59616dd433926c412
SSDEEP

384:VnBXapUxvdWiuEWi7HRN7ooiR9zvLXg4m4IBss264RE4TdE54Rr4RbiaGW4w14Ed:VEpHAoh9zThSpNxsS3T

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2408 wrote to memory of 1036	2408	rundll32.exe	WerFault.exe
PID 2408 wrote to memory of 1036	2408	rundll32.exe	WerFault.exe
PID 2408 wrote to memory of 1036	2408	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140_codecvt_ids.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2408 -s 80
  2⤵
  PID:1036