f910a13226f0cc0674db290c728e0474c91fffd6963e454f83d975014d4a785c

Analysis

max time kernel
138s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 20:16

Target

$PLUGINSDIR/libcurl.dll
Size

538KB
MD5

ce6ef90122f637328f2ae8759443e270
SHA1

a8c7dfbf3aaa8d3d8bb64fc1daabd03f64d45a54
SHA256

c86a70f6c216c2613c85b0f0a2dd35889222f135546f9384770e4b675f1b6755
SHA512

4d7800df2b33eed0ae47b46c2ca99bf2cfc12ad5eef4b6f5b0e8bc729f9ee0e8910af1529e435d9960f3bd1519bc1de2b0f98cc93efdfca21795a82e668afac7
SSDEEP

12288:C/IHHOrHRdCWHqzUiZSRNNoLykEzhucAddw3NWrPWOoqax2b4Xa06WRb21Jkz:C8sdW97wdWTLocb0X6WgUz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2860	4156	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 4156	1056	rundll32.exe	87
PID 1056 wrote to memory of 4156	1056	rundll32.exe	87
PID 1056 wrote to memory of 4156	1056	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl.dll,#1
  2⤵
  PID:4156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 632
    3⤵
    - Program crash
    PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4156 -ip 4156
1⤵
PID:4076