a8e7fcd3082840075dae30a1604cffb215299f554561ba6258658d5511bb9d6d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/01/2025, 18:50

Target

msvcp140.dll
Size

563KB
MD5

4065afa57eff9507ac798a241955c225
SHA1

f77b7a1efcdf47bc7beb3ba7223ab4644ca6af29
SHA256

65d7208cf74904cb01213e9e59e3d6186746614b33bdb7dfc5cd95db4c01b69d
SHA512

f35c8671e9de47e84ee7666d1ec399ad26e8b017f71433ff92e786f8abd6db36424f96b08eb32f43fe1ed8e98df01acb5f03227427d04d4c6fa2f501d9056883
SSDEEP

12288:c7dqZ1EqSGQEwkcz6sm7UtgZ/29z7mnuMG7NaekWdgJMKZ+h7rUh0wvaQEKZm+jP:cZNg+h7r6iQEKZm+jWodEERAH8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2352	1984	rundll32.exe	31
PID 1984 wrote to memory of 2352	1984	rundll32.exe	31
PID 1984 wrote to memory of 2352	1984	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1984 -s 80
  2⤵
  PID:2352