29081253537f8c90e40915430d712693ceb7cc941718f53395708067e142a041

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-01-2025 00:11

Target

vcruntime140.dll
Size

116KB
MD5

be8dbe2dc77ebe7f88f910c61aec691a
SHA1

a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256

4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512

0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP

1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2024	3068	rundll32.exe	30
PID 3068 wrote to memory of 2024	3068	rundll32.exe	30
PID 3068 wrote to memory of 2024	3068	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3068 -s 80
  2⤵
  PID:2024