18f7857e3bb5f9f830917c9073d3c339bf7b3e14fcd3edfdca976287f41536c6

Analysis

max time kernel
242s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:10

Target

m32/libcurl-4.dll
Size

371KB
MD5

fe7aa25560b4c042bb7efaac5a68a76a
SHA1

78224cf2b3003d4f47d0349e8dffa0a7a09a4370
SHA256

f4c090a71fec5018f913104d433b4bacb8b8b25bbe6d05ec9181c44e06da170b
SHA512

c4c67da79a8b1ddbe1accfc60945e2604901b04b0efc75e90d2f127ea7af01e7435de9a1e9cf598861b683abde2729db7c3e69005ff265cdcf7ddeddf0d75836
SSDEEP

6144:lPTcVeb9zK35VZJJ+4r8FFglQ1dKPKBCsHd+15Sp4FXyNAiaCol:JTUep235ZJ+4rOFgltbsHuA4gNAianl

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4628 3388 WerFault.exe rundll32.exe
5068 3388 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4628	3388	WerFault.exe	rundll32.exe
5068	3388	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2112 wrote to memory of 3388	2112	rundll32.exe	rundll32.exe
PID 2112 wrote to memory of 3388	2112	rundll32.exe	rundll32.exe
PID 2112 wrote to memory of 3388	2112	rundll32.exe	rundll32.exe
PID 3388 wrote to memory of 4628	3388	rundll32.exe	WerFault.exe
PID 3388 wrote to memory of 4628	3388	rundll32.exe	WerFault.exe
PID 3388 wrote to memory of 4628	3388	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m32\libcurl-4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m32\libcurl-4.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 632
3⤵
- Program crash
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 632
3⤵
- Program crash
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3388 -ip 3388
1⤵
PID:3248