7a39caf04d025428d5d9e5098fef74e22f59eee2c3686f676e235ae954b18b6d | Triage

Resubmissions

10/02/2025, 02:06

250210-cjg3laykgq 10

10/02/2025, 02:04

250210-chg17syrby 10

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/02/2025, 02:06

Sharing

Report Analysis Logs

General

Target

concrt140.dll
Size

325KB
MD5

eb42b164d603672e07997019bb00e4ad
SHA1

9f73f2323b167215874a7d3dd4a7f7750312f219
SHA256

dabdb0732b2fc14040cedbbfd369d9eb3c7a2e66b38a79892e1c05e6d6a8526d
SHA512

1e74ea24bfcaa5dd1ef0654a45f96c99900dbfca406bcfb73ae3abfdad7c1d0d12e773817a9ab3fd8d1d927a85d5fa6447b3c521192dccf33957f5bea00b3cc8
SSDEEP

6144:1ndGd0wl7XIbBx5C9YtkO2MUWghMWbGynWzgcZ6rO4i47:zCpIRC6tcG5zKiU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2848	2828	rundll32.exe	30
PID 2828 wrote to memory of 2848	2828	rundll32.exe	30
PID 2828 wrote to memory of 2848	2828	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\concrt140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2828 -s 80
  2⤵
  PID:2848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads