3f4b288335a86c908e015d254715d6fb9838f729e13aa3c06e53792ddaf59cad

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 08:56

Target

Sample/msvcp140.dll
Size

557KB
MD5

7db24201efea565d930b7ec3306f4308
SHA1

880c8034b1655597d0eebe056719a6f79b60e03c
SHA256

72fe4598f0b75d31ce2dc621e8ef161338c6450bb017cd06895745690603729e
SHA512

bac5729a3eb53e9bc7b680671d028cabef5ea102dfaa48a7c453b67f8ecb358db9f8fb16b3b1d9ea5a2dff34f459f6ac87f3a563c736d81d31048766198ff11e
SSDEEP

12288:Rsjw3shF+jss1I8CgEWTe5+YMCMGz2MMY5U489wiyaf+QEKZm+jWodEEVksLd:Rs/5U4RBaf+QEKZm+jWodEECsL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2112 wrote to memory of 2408	2112	rundll32.exe	30
PID 2112 wrote to memory of 2408	2112	rundll32.exe	30
PID 2112 wrote to memory of 2408	2112	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Sample\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 80
  2⤵
  PID:2408