Overview

overview

8

Static

static

3

f80bc12ffe...51.exe

windows7-x64

8

f80bc12ffe...51.exe

windows10-2004-x64

8

kcinst.exe

windows7-x64

1

kcinst.exe

windows10-2004-x64

1

kcinst32.dll

windows7-x64

1

kcinst32.dll

windows10-2004-x64

1

letsvpn-latest.exe

windows7-x64

8

letsvpn-latest.exe

windows10-2004-x64

8

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

driver/tap0901.sys

windows10-2004-x64

1

driver/tapinstall.exe

windows7-x64

1

driver/tapinstall.exe

windows10-2004-x64

1

libCLI.dll

windows7-x64

1

libCLI.dll

windows10-2004-x64

1

msvcp140.dll

windows7-x64

1

msvcp140.dll

windows10-2004-x64

1

vcruntime140.dll

windows7-x64

1

vcruntime140.dll

windows10-2004-x64

1

vcruntime140_1.dll

windows7-x64

1

vcruntime140_1.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    121s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/11/2024, 14:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    vcruntime140.dll

  • Size

    107KB

  • MD5

    ded0fb624c202e3595551256e3bc0ba2

  • SHA1

    97c0c52f69fe76c9f1469f3cef78e12e598ad325

  • SHA256

    2aebc4e4ca7645188d12950ca68b39f71ebd86da4228419800c1b1a3754f3130

  • SHA512

    e7b5b9e7898361254903f1dd8b6f4a49fc0854460a427f4249e9e5e1b95c116a7be61e9ec43f02f70a56ad5ad3ce5205d748525cb40829cc49dd835b605c9fef

  • SSDEEP

    3072:yD7mylIhkoQpdK9H9YOecbKVfT8KuKnK/:uiylZoQwH93ecbKZ57K/

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2372 -s 80
      2⤵
        PID:2392

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads