{
  "author": "ckeller@fusioncybersecurity.us",
  "cat": "New Code Atypical Path",
  "detect": {
    "event": {
      "FILE_PATH": "C:\\Windows\\Temp\\{7F39EE9E-D03D-4C93-A8AB-AE02BB6A0703}\\.cr\\vc_redist.x64.exe",
      "HASH": "568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd",
      "PROCESS_ID": 7852
    },
    "routing": {
      "arch": 2,
      "did": "",
      "event_id": "aefb51fe-e146-4d74-94a8-72c94442d511",
      "event_time": 1773605350367,
      "event_type": "NEW_DOCUMENT",
      "ext_ip": "23.128.32.10",
      "hostname": "desktop-3nfb237",
      "iid": "b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175",
      "int_ip": "192.168.50.40",
      "latency": 1351,
      "moduleid": 2,
      "oid": "d3541070-8b0e-4663-8a6a-aa0727aacd36",
      "parent": "206f993ed2df4ffef6ba071a69b711e0",
      "plat": 268435456,
      "sid": "ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136",
      "tags": [
        "fusion-soc-alert",
        "fusion-soc-case",
        "fusion-soc-pulled",
        "fusion-soc-triage",
        "fusionsoc-critical",
        "fusionsoc-high",
        "fusionsoc-investigated",
        "qucikbooks",
        "windows",
        "yara_detection_memory"
      ],
      "this": "8b2776f1ed4c0f8b1078ce2469b711e7"
    }
  },
  "detect_id": "55dfea56-2cbc-43b0-b31c-19da69b711e7",
  "gen_time": 1773605351737,
  "link": "https://app.limacharlie.io/orgs/d3541070-8b0e-4663-8a6a-aa0727aacd36/sensors/ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136/timeline?time=1773605350\u0026selected=8b2776f1ed4c0f8b1078ce2469b711e7",
  "namespace": "general",
  "routing": {
    "arch": 2,
    "did": "",
    "event_id": "aefb51fe-e146-4d74-94a8-72c94442d511",
    "event_time": 1773605350367,
    "event_type": "NEW_DOCUMENT",
    "ext_ip": "23.128.32.10",
    "hostname": "desktop-3nfb237",
    "iid": "b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175",
    "int_ip": "192.168.50.40",
    "latency": 1351,
    "moduleid": 2,
    "oid": "d3541070-8b0e-4663-8a6a-aa0727aacd36",
    "parent": "206f993ed2df4ffef6ba071a69b711e0",
    "plat": 268435456,
    "sid": "ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136",
    "tags": [
      "fusion-soc-alert",
      "fusion-soc-case",
      "fusion-soc-pulled",
      "fusion-soc-triage",
      "fusionsoc-critical",
      "fusionsoc-high",
      "fusionsoc-investigated",
      "qucikbooks",
      "windows",
      "yara_detection_memory"
    ],
    "this": "8b2776f1ed4c0f8b1078ce2469b711e7"
  },
  "source": "d3541070-8b0e-4663-8a6a-aa0727aacd36.b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175.ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136.10000000.2",
  "source_rule": "general.NEW FILE WRITE BYTES SAMPLE GRAB",
  "ts": 1773605351000
}

{
  "virustotal": {
    "malicious": false,
    "provider": "virustotal",
    "reputation": 0,
    "stats": {
      "confirmed-timeout": 0,
      "failure": 0,
      "harmless": 0,
      "malicious": 0,
      "suspicious": 0,
      "timeout": 1,
      "type-unsupported": 4,
      "undetected": 71
    }
  }
}

{
  "confidence": 0.95,
  "false_positive_reason": "Microsoft Visual C++ Redistributable is a legitimate software component. The detection rule appears to be overly broad in flagging new file writes for common system-installed components.",
  "investigation_questions": [
    "Is there a known application that requires Visual C++ runtime libraries?",
    "Has this installer been downloaded or installed recently on the host?"
  ],
  "ioc_analysis": "The file vc_redist.x64.exe is a well-known Microsoft component used to install runtime libraries for Visual C++. The extension .cr indicates it is a compressed archive, typical for redistributable packages. This process is not running from System32 but rather in Temp, which is expected behavior for downloaded installers.",
  "iocs_extracted": [
    {
      "type": "file_path",
      "value": "C:\\Windows\\Temp\\{7F39EE9E-D03D-4C93-A8AB-AE02BB6A0703}\\vc_redist.x64.exe"
    },
    {
      "type": "hash",
      "value": "568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd"
    }
  ],
  "mitre_techniques": [],
  "recommended_actions": [
    "Manual analyst review required \u2014 AI models disagree or one model failed",
    "Allow the process to complete its installation",
    "Monitor for subsequent execution of extracted files from this archive",
    "Verify file signature if available"
  ],
  "risk_score": 10,
  "severity": "high",
  "summary": "**Vote: SPLIT (1/2 -\u003e SUSPICIOUS)**\n\n### \u264a Gemini Analysis (Primary)\nFailed or timed out.\n\n---\n\n### \ud83e\udd16 Qwen Analysis (Secondary)\n**Verdict:** false_positive | **Confidence:** 0.95\nThe detection flagged a Microsoft Visual C++ Redistributable installer in the Windows Temp directory, which is a common legitimate activity for software installation and updates.\n\n**IOC Analysis:** The file vc_redist.x64.exe is a well-known Microsoft component used to install runtime libraries for Visual C++. The extension .cr indicates it is a compressed archive, typical for redistributable packages. This process is not running from System32 but rather in Temp, which is expected behavior for downloaded installers.",
  "verdict": "suspicious",
  "voting": {
    "auto_action": "manual_review",
    "mode": "split",
    "total_models": 2,
    "vote_summary": [
      "qwen3.5:4b: false_positive (low, 95% confidence)"
    ],
    "votes": [],
    "winning_count": 1,
    "winning_verdict": "suspicious"
  }
}