7a39caf04d025428d5d9e5098fef74e22f59eee2c3686f676e235ae954b18b6d | Triage

Resubmissions

10-02-2025 02:06

250210-cjg3laykgq 10

10-02-2025 02:04

250210-chg17syrby 10

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 02:06

Sharing

Report Analysis Logs

General

Target

msvcp140_codecvt_ids.dll
Size

26KB
MD5

e42f86965ceb093d95b9c93bd87b179d
SHA1

4184b271261b3eb9c0193e5e6874b8847b18dc22
SHA256

1e56cee876940affe9883aeccee9132280d03fd4282ab6552adf75fbeeed2bac
SHA512

6b355d468fd8214cf50cef7d30a9098c812b60f0215726da937361e0cf2d2b8362ae5bc2b88c5e8dd48298c13b1be1a52d7f68d075c2a8d9c93480354b0e8420
SSDEEP

384:OTDpEPOCAbHWi/EWz46QpBj0HRN7bX8QHRN7ep1x09lT9D:qNEFa1XqWbX88epQD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1952	2016	rundll32.exe	30
PID 2016 wrote to memory of 1952	2016	rundll32.exe	30
PID 2016 wrote to memory of 1952	2016	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140_codecvt_ids.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2016 -s 80
  2⤵
  PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads