3f8da5d739115b83063d1b10675a2c0d3ed0e9df1f3a919da35915351c437c12 | Triage

Resubmissions

19/12/2023, 13:17

231219-qjq76acbfm 3

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/12/2023, 13:17

Sharing

Report Analysis Logs

General

Target

libcurl.dll
Size

357KB
MD5

94f86810eb79615f97d72d8ad02898e1
SHA1

e7049e4f0d1e119401b38b9dcbf3ca9d6e4658f8
SHA256

3f8da5d739115b83063d1b10675a2c0d3ed0e9df1f3a919da35915351c437c12
SHA512

42ed49c66b823bbd5115bdf5395dc79d70c6bcc7313fbc1ce08280a0a2b77bea6fbddddde79e32d5bbf2f2ab4b72d7d0a4eccfc3cb9f08f067ceace2527f19d8
SSDEEP

6144:O8I388llM52ef90EyNjVPS7ZOAGB+Glo+PpfC3c1Ch38lzqRj+h:lL8llA0EMVkUl/51Chwz84

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2928	2212	rundll32.exe	28
PID 2212 wrote to memory of 2928	2212	rundll32.exe	28
PID 2212 wrote to memory of 2928	2212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2212 -s 100
  2⤵
  PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads