ac597c69333f99b6d9f7b6deb58c8f19aaee37c6a2fc5c4155559c0531b6ceeb

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 00:23

Target

libcurl/lib/Debug/libcurl.dll
Size

627KB
MD5

52c34fcd7ea2fcab9df10ee5630fba3b
SHA1

bfdd69b010e4047230c9e65a8f13adfb3565b9bf
SHA256

5f97068899cb4c9eb4456f8a3aabc993ee1df84cce2f9509b988e1d9cbcbf7b6
SHA512

2d4ff396e6576910a5f22a9b5268745a08cc02603f5f5bc26f4868cde4054f7aad10e5fd0da83c0ded605a83ce5c81ebbb1815f53fc782a6e6821c332e1b43aa
SSDEEP

6144:IL6tBtOJ3geWpJh9UyXLpiIi8OwONAA/gY5SHMQ3uleeIwub5ZeM4z0oWKWG:ILeBeQug4SHMQ3uljIFb54MaWKW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	1196	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1196	2076	rundll32.exe	28
PID 2076 wrote to memory of 1196	2076	rundll32.exe	28
PID 2076 wrote to memory of 1196	2076	rundll32.exe	28
PID 2076 wrote to memory of 1196	2076	rundll32.exe	28
PID 2076 wrote to memory of 1196	2076	rundll32.exe	28
PID 2076 wrote to memory of 1196	2076	rundll32.exe	28
PID 2076 wrote to memory of 1196	2076	rundll32.exe	28
PID 1196 wrote to memory of 2052	1196	rundll32.exe	29
PID 1196 wrote to memory of 2052	1196	rundll32.exe	29
PID 1196 wrote to memory of 2052	1196	rundll32.exe	29
PID 1196 wrote to memory of 2052	1196	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl\lib\Debug\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl\lib\Debug\libcurl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 232
    3⤵
    - Program crash
    PID:2052

memory/1196-0-0x0000000074BC0000-0x0000000074CA1000-memory.dmp

Filesize
900KB

Download
memory/1196-1-0x0000000074AD0000-0x0000000074BB1000-memory.dmp

Filesize
900KB

Download
memory/1196-2-0x0000000074AD0000-0x0000000074BB1000-memory.dmp

Filesize
900KB

Download
memory/1196-3-0x0000000074690000-0x00000000746D8000-memory.dmp

Filesize
288KB

Download
memory/1196-4-0x0000000074BC0000-0x0000000074CA1000-memory.dmp

Filesize
900KB

Download