9077ef03723211f1f5cb3f26bc292f162d5de9900778042db47d74e437216142

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/01/2025, 11:25

Target

msvcp120.dll
Size

644KB
MD5

72664fbad17678faecae97481e8e783c
SHA1

8edb9feb6d3a737a88dfd3213965d1ea4f64c3f6
SHA256

2285fc6fc936c38d124b6ea5585b81ce83de235b460cb27383a15003eb5ca116
SHA512

2cb7f2fcf69a28f0509fbea632859d82b9ff5d0ec318cf500eddc1f02ef887cfdbee2162eb321ca8f3b0f374930ecf69c97653b16d8dddedd73abe0993b5466e
SSDEEP

12288:82fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwn6:JuJzCaK9AB2EKZm+GWodEEwn6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1792	1728	rundll32.exe	31
PID 1728 wrote to memory of 1792	1728	rundll32.exe	31
PID 1728 wrote to memory of 1792	1728	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp120.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1728 -s 80
  2⤵
  PID:1792