1adf1646b9113fd13d0e6745b83a59fae2160ba93ecade45be63dd210cf6c8a6

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 04:18

Target

__x64___setup___x32__/mscms/msvcp120.dll
Size

644KB
MD5

c2028ba6c66363b36ea659ca8816265d
SHA1

5e2bda10ad417466290dc08fd6ee8bc5fcf0ebbd
SHA256

3b92e964404e3f94531e7d7c4c7419561d9eca6accd98dc3979c9e3596db444c
SHA512

28e87d7360c4bd2eb30152173da6fdf30340b5ff0186a68f26514088dcc15758851afd01a179e976a91a9a85f9c1ee0cfa40308ed9d42654739acf6f6dd773f4
SSDEEP

12288:FOB4p+q4N8d4l2ms4cTHN+m+gy/vEPYysExtvsIvXi1ZG2EKZm+GWodEEpvY/p:iAtvsIvL2EKZm+GWodEEpvYh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2112 wrote to memory of 1932	2112	rundll32.exe	WerFault.exe
PID 2112 wrote to memory of 1932	2112	rundll32.exe	WerFault.exe
PID 2112 wrote to memory of 1932	2112	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__x64___setup___x32__\mscms\msvcp120.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2112 -s 80
2⤵
PID:1932