8050946d45275d1d9a207b61e1e7c69f906193fe120b111497bb15960f9ca379

Analysis

Target

libcurlpp.dll
Size

54KB
MD5

e6e578373c2e416289a8da55f1dc5e8e
SHA1

b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA256

43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA512

9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3932 500 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3932	500	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3932 WerFault.exe
Token: SeBackupPrivilege 3932 WerFault.exe
Token: SeDebugPrivilege 3932 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4060 wrote to memory of 500	4060	rundll32.exe	rundll32.exe
PID 4060 wrote to memory of 500	4060	rundll32.exe	rundll32.exe
PID 4060 wrote to memory of 500	4060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurlpp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurlpp.dll,#1
2⤵
PID:500

memory/500-114-0x0000000000000000-mapping.dmp

Download
memory/500-116-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/500-115-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/500-118-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/500-119-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/500-117-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/500-120-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/500-121-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download