3f4b288335a86c908e015d254715d6fb9838f729e13aa3c06e53792ddaf59cad | Triage

Analysis

max time kernel
86s
max time network
21s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 08:56

Sharing

Report Analysis Logs

General

Target

Sample/vcruntime140_1.dll
Size

37KB
MD5

75e78e4bf561031d39f86143753400ff
SHA1

324c2a99e39f8992459495182677e91656a05206
SHA256

1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
SHA512

ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756
SSDEEP

768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2464 wrote to memory of 2344	2464	rundll32.exe	WerFault.exe
PID 2464 wrote to memory of 2344	2464	rundll32.exe	WerFault.exe
PID 2464 wrote to memory of 2344	2464	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Sample\vcruntime140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2464 -s 80
  2⤵
  PID:2344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads