33d0bc76fa1c09fe48e29f19ffd56325f1b435c4eac6c81ae7bd2ae26ab7444e | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
25/02/2025, 17:35

Sharing

Report Analysis Logs

General

Target

vcruntime140.dll
Size

115KB
MD5

bb36d85252327ebddde71686429f1c3a
SHA1

febf6d0c478a170fa20a8bdecc24cb1e30a35521
SHA256

4d90b1c669b3a93d33ca62f4c7374a3fe32a2a3dccb46f7378ee2100d7e335b8
SHA512

e5e139c07cfd0aa0606baec947924ba319cce09155f215560d1749a9db21d68e8209902fc52eede4900ecd9d7c93c79b2c6ae2133dfa500c2371a94b61f3009b
SSDEEP

3072:fV3iC0h9q4v6XjKwoecbq8qBTSJ/e+1cR:f0C0h97cmZecbq8Q6C

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 2020	324	rundll32.exe	30
PID 324 wrote to memory of 2020	324	rundll32.exe	30
PID 324 wrote to memory of 2020	324	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 324 -s 80
  2⤵
  PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads