e7490d25eb3e1553ec66c42b1474a2ff025072f3017eb882f7b15da0379ce9e0

Analysis

max time kernel
1670s
max time network
1178s
platform
windows10-2004_x64
resource
win10v2004-20240221-uk
resource tags

arch:x64arch:x86image:win10v2004-20240221-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
25-02-2024 20:41

Target

$PLUGINSDIR/libcurl.dll
Size

460KB
MD5

fe5e6aecb98bbcb2cb0e826526dea007
SHA1

936f0e2ade5a909e714c307c1e2aa2702f1e464c
SHA256

ec5f18199dc57130082315bfb6baedb8614da92ae256019a30b5880dded9ae47
SHA512

7ae9fa473e612791a606f6fd7043a5385b3b4eb3bc612652c05d8520d2b2f766232c03de436636362c60b08cbdfec919a35dc07075b2877753ca4779c9cdf0d1
SSDEEP

6144:I4qgLAB0rrD9mvNqespJ9Y0wf1z9oBVePEZuRblbcLx9v0Q076ImWcuUVm2r:I4qgLAB6uqDpPYRfRmBUPEZOYL5nGOmO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1672 4896 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1672	4896	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4704 wrote to memory of 4896	4704	rundll32.exe	rundll32.exe
PID 4704 wrote to memory of 4896	4704	rundll32.exe	rundll32.exe
PID 4704 wrote to memory of 4896	4704	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4704

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl.dll,#1
2⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 640
3⤵
- Program crash
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4896 -ip 4896
1⤵
PID:232