005cc5fcee47af9761a6d41b5789683ad454ffa416a7bd7a9d3472ddf9fc230e

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 02:47

Target

$PLUGINSDIR/libcurl_x86.dll
Size

2.1MB
MD5

a26e75c0407c87786eea42febdb32532
SHA1

27e52fdca023cb8f031cd55ac37965d93f7f7da7
SHA256

635f988beb849c6510f54f681387bf810c2266bd27834c5a9c160cbfe6df44d4
SHA512

fdd9760442579ad2a3df4f31464f9e66bc19a4390fa1c81afb516cce817097b5324024f712d9c1bf1a11ad30324f5a8aa83c72a732e1197e8804ab806d3859e6
SSDEEP

49152:nGUR9r6hl8IXBPZ68L20v/SU8Y7NriOPquwgtJIpT:nGUR9r6b8IbBLjv/SUp7NriSg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	1756	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 1756 wrote to memory of 2124	1756	rundll32.exe	29
PID 1756 wrote to memory of 2124	1756	rundll32.exe	29
PID 1756 wrote to memory of 2124	1756	rundll32.exe	29
PID 1756 wrote to memory of 2124	1756	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl_x86.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 232
    3⤵
    - Program crash
    PID:2124