18f7857e3bb5f9f830917c9073d3c339bf7b3e14fcd3edfdca976287f41536c6

Analysis

max time kernel
6s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:10

Target

m32/libcurl-4.dll
Size

371KB
MD5

fe7aa25560b4c042bb7efaac5a68a76a
SHA1

78224cf2b3003d4f47d0349e8dffa0a7a09a4370
SHA256

f4c090a71fec5018f913104d433b4bacb8b8b25bbe6d05ec9181c44e06da170b
SHA512

c4c67da79a8b1ddbe1accfc60945e2604901b04b0efc75e90d2f127ea7af01e7435de9a1e9cf598861b683abde2729db7c3e69005ff265cdcf7ddeddf0d75836
SSDEEP

6144:lPTcVeb9zK35VZJJ+4r8FFglQ1dKPKBCsHd+15Sp4FXyNAiaCol:JTUep235ZJ+4rOFgltbsHuA4gNAianl

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1972 1664 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1972	1664	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1428 wrote to memory of 1664	1428	rundll32.exe	rundll32.exe
PID 1428 wrote to memory of 1664	1428	rundll32.exe	rundll32.exe
PID 1428 wrote to memory of 1664	1428	rundll32.exe	rundll32.exe
PID 1428 wrote to memory of 1664	1428	rundll32.exe	rundll32.exe
PID 1428 wrote to memory of 1664	1428	rundll32.exe	rundll32.exe
PID 1428 wrote to memory of 1664	1428	rundll32.exe	rundll32.exe
PID 1428 wrote to memory of 1664	1428	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1972	1664	rundll32.exe	WerFault.exe
PID 1664 wrote to memory of 1972	1664	rundll32.exe	WerFault.exe
PID 1664 wrote to memory of 1972	1664	rundll32.exe	WerFault.exe
PID 1664 wrote to memory of 1972	1664	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m32\libcurl-4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m32\libcurl-4.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 236
3⤵
- Program crash
PID:1972

memory/1664-54-0x0000000000000000-mapping.dmp

Download
memory/1664-55-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x0000000000000000-mapping.dmp

Download