204675ed11d30dd3dbc631f798b4364c128eb4e9413f1da195790abf880e8b9a | Triage

Analysis

max time kernel
80s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2022 17:41

Sharing

Report Analysis Logs

General

Target

libcurl.dll
Size

420KB
MD5

a0722b584c374ec7517311922c196df2
SHA1

100761497569f752e064643c9aa3510d10d2245a
SHA256

d65cc86cbc6181eb5732463e4976ea7ee63054acdd2015820a43fd6b8768cbe8
SHA512

c8f1b27d5e39fcd8432728bd617d154d5f63232dd44f40a1a06df7db1f3ec6bc412c7cc4063946faf1c4da49b8576c338c4b1f4d9e66336831e0965a700fd371

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3724 736 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4140 wrote to memory of 736	4140	rundll32.exe	rundll32.exe
PID 4140 wrote to memory of 736	4140	rundll32.exe	rundll32.exe
PID 4140 wrote to memory of 736	4140	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl.dll,#1
2⤵
PID:736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 644
3⤵
- Program crash
PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 736 -ip 736
1⤵
PID:4704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/736-130-0x0000000000000000-mapping.dmp

Download