26452bc527e96dc49c07a506f363c92ad485dc087a1d5c6ad4e5c64c1b463ef2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/02/2025, 11:51

Target

vcruntime140_1.dll
Size

35KB
MD5

f124d735ebff3330b5b6cfa7df1c17be
SHA1

ad9cba122a47a4be8c3ec3ac6ce2d920f7e40baa
SHA256

d34288fcb286d4e2056f969767a65f09cf6e71ad27fe3af4edd1584cd95fd55f
SHA512

e5f1fd40b28861f3f7e5851e47b60a3035216129e0491f112e8ebc4dacd4c890a06caead8aa7d4ae7b64bd2b0c08e1ba17bad924534fcedec406895ca8af8c09
SSDEEP

384:lbPvL6j8qS3RZ0IQ8tq7+B5Wjfy4hGCrNWrSVbWENXfGj5y85xIam4WrNNW7QHRV:BvGj8qSBoEiy4hvCsjNveIamvW8JuW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2352	1788	rundll32.exe	30
PID 1788 wrote to memory of 2352	1788	rundll32.exe	30
PID 1788 wrote to memory of 2352	1788	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1788 -s 80
  2⤵
  PID:2352