005cc5fcee47af9761a6d41b5789683ad454ffa416a7bd7a9d3472ddf9fc230e | Triage

Analysis

max time kernel
90s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 02:55

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/libcurl_x86.dll
Size

2.1MB
MD5

a26e75c0407c87786eea42febdb32532
SHA1

27e52fdca023cb8f031cd55ac37965d93f7f7da7
SHA256

635f988beb849c6510f54f681387bf810c2266bd27834c5a9c160cbfe6df44d4
SHA512

fdd9760442579ad2a3df4f31464f9e66bc19a4390fa1c81afb516cce817097b5324024f712d9c1bf1a11ad30324f5a8aa83c72a732e1197e8804ab806d3859e6
SSDEEP

49152:nGUR9r6hl8IXBPZ68L20v/SU8Y7NriOPquwgtJIpT:nGUR9r6b8IbBLjv/SUp7NriSg

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3100	4672	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 4672	1700	rundll32.exe	85
PID 1700 wrote to memory of 4672	1700	rundll32.exe	85
PID 1700 wrote to memory of 4672	1700	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl_x86.dll,#1
  2⤵
  PID:4672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 636
    3⤵
    - Program crash
    PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4672 -ip 4672
1⤵
PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads