f910a13226f0cc0674db290c728e0474c91fffd6963e454f83d975014d4a785c

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 20:16 UTC

Target

$PLUGINSDIR/libcurl.dll
Size

538KB
MD5

ce6ef90122f637328f2ae8759443e270
SHA1

a8c7dfbf3aaa8d3d8bb64fc1daabd03f64d45a54
SHA256

c86a70f6c216c2613c85b0f0a2dd35889222f135546f9384770e4b675f1b6755
SHA512

4d7800df2b33eed0ae47b46c2ca99bf2cfc12ad5eef4b6f5b0e8bc729f9ee0e8910af1529e435d9960f3bd1519bc1de2b0f98cc93efdfca21795a82e668afac7
SSDEEP

12288:C/IHHOrHRdCWHqzUiZSRNNoLykEzhucAddw3NWrPWOoqax2b4Xa06WRb21Jkz:C8sdW97wdWTLocb0X6WgUz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2776	1244	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 1244	816	rundll32.exe	28
PID 816 wrote to memory of 1244	816	rundll32.exe	28
PID 816 wrote to memory of 1244	816	rundll32.exe	28
PID 816 wrote to memory of 1244	816	rundll32.exe	28
PID 816 wrote to memory of 1244	816	rundll32.exe	28
PID 816 wrote to memory of 1244	816	rundll32.exe	28
PID 816 wrote to memory of 1244	816	rundll32.exe	28
PID 1244 wrote to memory of 2776	1244	rundll32.exe	29
PID 1244 wrote to memory of 2776	1244	rundll32.exe	29
PID 1244 wrote to memory of 2776	1244	rundll32.exe	29
PID 1244 wrote to memory of 2776	1244	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 228
    3⤵
    - Program crash
    PID:2776