6bb7b2ce0976aa09fae287453052c9c3e0e3ee47ef9db0e00da39e25dc408af5 | Triage

Resubmissions

02-01-2025 03:26

250102-dzccqa1jb1 10

02-01-2025 03:25

250102-dywd7s1jat 10

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 03:26

Sharing

Report Analysis Logs

General

Target

vcruntime140_1.dll
Size

48KB
MD5

7e986e7469d9ab3b1138353418da1793
SHA1

77903692aae688f6d5b04511d5006c66ce4daf8b
SHA256

0e560532e721b6938dafe4055eedd0251ba5eb5994cd96937cebbcf16a7ddae5
SHA512

6c8951ae9a0e329cf32eed8bf32bd83294e7a1cf7f16dd716cedbed4caf39e56e62c5f639091f9711922443ada7dbc61dffcace093211d70a85821f19883cbea
SSDEEP

768:uzzO6ujT3MbR3vXCz6Sz2q83yvjdsrU9zcgElebe9zVFZ:rq/XU63Cjd9zcZebazDZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2088	1956	rundll32.exe	29
PID 1956 wrote to memory of 2088	1956	rundll32.exe	29
PID 1956 wrote to memory of 2088	1956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1956 -s 80
  2⤵
  PID:2088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads