e3dcd71e32b11ca32c66e5187c2d4191401f885afbe068163ad8b054da362de3

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13/07/2023, 23:09

Target

updater/libcurl.dll
Size

666KB
MD5

279af83dba39efe50664ada107be8031
SHA1

02f9cef56b197ffdd8be2a00a5aadf901c43333a
SHA256

23e72679a0ea58788b5efc1b1449c85a740c178b921b90846ffeb9b461edf71d
SHA512

30390e8cf41edfee0a47274dd52ca5b851fffc7b74e96c9a0c5c28dc1714acde35adc5ccd53dae846e7b2f6f0abbda5845e7dbab35ea7c20ceb7dba78162e7cc
SSDEEP

12288:TvIArRDjmkqR6tv3cKOuWmDxyEI+mVLIOlwBnq48+MVjt1wIbz:TvI9ptuWKxyEI+mNIOlenqd+MVxhz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2132	2408	WerFault.exe	12

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2132	2408	rundll32.exe	28
PID 2408 wrote to memory of 2132	2408	rundll32.exe	28
PID 2408 wrote to memory of 2132	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\updater\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2408 -s 100
  2⤵
  - Program crash
  PID:2132