6184d03f97b181a2e2ffa02edcb07d2ca4924b73352b1ea6be251265dfa26a1a

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07/06/2023, 17:54

Target

libcurl.dll
Size

96KB
MD5

972145d3a9f7d0c036ff104f9ebb2ed4
SHA1

aaec8ed82f418f4b734c21f7b66d17806d2fe9b9
SHA256

6184d03f97b181a2e2ffa02edcb07d2ca4924b73352b1ea6be251265dfa26a1a
SHA512

bb16949b174fea9d37e57c44deb2eb3e8500df9454bc9b9e26f83cbaa409b2ae339a49222c84a171c456c8004ba8e7eb71b63a5392c016937ca0362d6bdc6888
SSDEEP

1536:N+LFV9m+8FtxNCwIwLRT7j5T5i+emfrDGNZgMvwsWfxLcdrqsUPyY+2/aqvps:N+xm+qNCw9RT7j5zGNuBarq1PyYL/as

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1224	916	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 916	1264	rundll32.exe	28
PID 1264 wrote to memory of 916	1264	rundll32.exe	28
PID 1264 wrote to memory of 916	1264	rundll32.exe	28
PID 1264 wrote to memory of 916	1264	rundll32.exe	28
PID 1264 wrote to memory of 916	1264	rundll32.exe	28
PID 1264 wrote to memory of 916	1264	rundll32.exe	28
PID 1264 wrote to memory of 916	1264	rundll32.exe	28
PID 916 wrote to memory of 1224	916	rundll32.exe	29
PID 916 wrote to memory of 1224	916	rundll32.exe	29
PID 916 wrote to memory of 1224	916	rundll32.exe	29
PID 916 wrote to memory of 1224	916	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 224
    3⤵
    - Program crash
    PID:1224