33d0bc76fa1c09fe48e29f19ffd56325f1b435c4eac6c81ae7bd2ae26ab7444e | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/02/2025, 17:31

Sharing

Report Analysis Logs

General

Target

msvcp140.dll
Size

574KB
MD5

e82a9818d8caf6c4ca3536bfce5b5650
SHA1

cc2113788421cc90988f21a004b7aaa717232a8c
SHA256

202d7f06e3d4f4fa188832e131664846979c0c81ffa86f91728431addffafbfb
SHA512

416c21778acab86527e9f3f237e22bafaaf1031ce28facf913d143c99c5c57ee0f13771db785e7378031f16643655d5233a5cc7ef10f41b764a039167fb65095
SSDEEP

12288:Qbxu4DawI5n+BOJAc/FTo8cWojFjM0TvH9Dfd2AtluP+QEKZm+jWodEEVGU:Q3lfl1QEKZm+jWodEEkU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2932	2100	rundll32.exe	30
PID 2100 wrote to memory of 2932	2100	rundll32.exe	30
PID 2100 wrote to memory of 2932	2100	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2100 -s 112
  2⤵
  PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads