499ce7e26fd7b500c1e05570bc2266053862c18c5b37c2f72f5ad99a2e32149a | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 09:23

Sharing

Report Analysis Logs

General

Target

msvcp140.dll
Size

571KB
MD5

57e1c539476b9e59919baea9f5fd61e9
SHA1

9e856c8fd5ff6ec5681e28723e3d785d06095598
SHA256

ef27a68bdc1ee3d5d9a6a720b656bfb7604a8fac6aceb245a6eadc2788686d9f
SHA512

abfd8149c115c308321af9cb55c495a3b3d3cf1c8faa86e073fa42dd0c7aba9b1fb308d7bcdf8bde80a0254ffac86611bd9377e4d8bbbb638703cfbd7bee70c8
SSDEEP

12288:PmyAf3QHr+vzkNNpiBfxzL63R+/EE9WoF8888/QEKZm+jWodEEVXD:Pmu+d/EVy8888/QEKZm+jWodEExD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2420	2096	rundll32.exe	30
PID 2096 wrote to memory of 2420	2096	rundll32.exe	30
PID 2096 wrote to memory of 2420	2096	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2096 -s 80
  2⤵
  PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads