6184d03f97b181a2e2ffa02edcb07d2ca4924b73352b1ea6be251265dfa26a1a

Analysis

max time kernel
62s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2023, 17:54

Target

libcurl.dll
Size

96KB
MD5

972145d3a9f7d0c036ff104f9ebb2ed4
SHA1

aaec8ed82f418f4b734c21f7b66d17806d2fe9b9
SHA256

6184d03f97b181a2e2ffa02edcb07d2ca4924b73352b1ea6be251265dfa26a1a
SHA512

bb16949b174fea9d37e57c44deb2eb3e8500df9454bc9b9e26f83cbaa409b2ae339a49222c84a171c456c8004ba8e7eb71b63a5392c016937ca0362d6bdc6888
SSDEEP

1536:N+LFV9m+8FtxNCwIwLRT7j5T5i+emfrDGNZgMvwsWfxLcdrqsUPyY+2/aqvps:N+xm+qNCw9RT7j5zGNuBarq1PyYL/as

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3124	1800	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 1800	5060	rundll32.exe	80
PID 5060 wrote to memory of 1800	5060	rundll32.exe	80
PID 5060 wrote to memory of 1800	5060	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl.dll,#1
  2⤵
  PID:1800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 608
    3⤵
    - Program crash
    PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1800 -ip 1800
1⤵
PID:1320