9077ef03723211f1f5cb3f26bc292f162d5de9900778042db47d74e437216142 | Triage

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/01/2025, 11:25

Sharing

Report Analysis Logs

General

Target

msvcp100.dll
Size

603KB
MD5

0775f4c382842ce37cf8aa6d55835a6f
SHA1

6885f7cf2188fb2156b273cc790d23990b71ee9c
SHA256

4eda2ff10ce9659e78e7b64d90bd7967279924e2328bcd633023e629992e95ac
SHA512

a8bc64b3b815cfcaf6271ec21eb8896647dd9a71a82aa52af9a66136c61a41ce2b78bcece7b9dd166926931ec5e95148b875c9f4494ff2aee9312fe4b8363587
SSDEEP

12288:FoBFUsQ1H5FH3YUTd/dfePA7XrNvEKZm+aWodEEGblH7:2FUsQ1H5FHdggrNvEKZm+aWodEEIH7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2652	2656	rundll32.exe	30
PID 2656 wrote to memory of 2652	2656	rundll32.exe	30
PID 2656 wrote to memory of 2652	2656	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp100.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2656 -s 80
  2⤵
  PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads