a8e7fcd3082840075dae30a1604cffb215299f554561ba6258658d5511bb9d6d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/01/2025, 18:50

Target

msvcp140_app.dll
Size

258KB
MD5

d2cb94e6620e6b4966ce8c0b8449ecc8
SHA1

9709a0599ab40d882dfc591775d21b34330294b7
SHA256

11819dd5814ae27122cf838a89659c0593d976206db88d5de46ead806f40df68
SHA512

96aa28797209774effc9bccd8b0591bb132acb8a5b5ae6e0dc24715d36cdc94db193d41359d62d7edd7fcbccf42f63baad171f9d023d7dbe6d42bddca4e4af94
SSDEEP

3072:e8Mx3k2pFYZAECK7Z2me+w5c6PD41YlAHC2aWoo7dMEMEik8bB4lKY:evx6AECK7Z2me+wEaWoo7dMEMEik8dE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2352	2508	rundll32.exe	30
PID 2508 wrote to memory of 2352	2508	rundll32.exe	30
PID 2508 wrote to memory of 2352	2508	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140_app.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2508 -s 80
  2⤵
  PID:2352