ac597c69333f99b6d9f7b6deb58c8f19aaee37c6a2fc5c4155559c0531b6ceeb

Analysis

max time kernel
139s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 00:23

Target

libcurl/lib/Debug/libcurl.dll
Size

627KB
MD5

52c34fcd7ea2fcab9df10ee5630fba3b
SHA1

bfdd69b010e4047230c9e65a8f13adfb3565b9bf
SHA256

5f97068899cb4c9eb4456f8a3aabc993ee1df84cce2f9509b988e1d9cbcbf7b6
SHA512

2d4ff396e6576910a5f22a9b5268745a08cc02603f5f5bc26f4868cde4054f7aad10e5fd0da83c0ded605a83ce5c81ebbb1815f53fc782a6e6821c332e1b43aa
SSDEEP

6144:IL6tBtOJ3geWpJh9UyXLpiIi8OwONAA/gY5SHMQ3uleeIwub5ZeM4z0oWKWG:ILeBeQug4SHMQ3uljIFb54MaWKW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4140	3496	WerFault.exe	96

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 3496	3984	rundll32.exe	96
PID 3984 wrote to memory of 3496	3984	rundll32.exe	96
PID 3984 wrote to memory of 3496	3984	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl\lib\Debug\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl\lib\Debug\libcurl.dll,#1
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 636
    3⤵
    - Program crash
    PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3496 -ip 3496
1⤵
PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:976

memory/3496-0-0x0000000075080000-0x0000000075161000-memory.dmp

Filesize
900KB

Download
memory/3496-1-0x0000000074F70000-0x0000000074FB8000-memory.dmp

Filesize
288KB

Download
memory/3496-2-0x0000000075080000-0x0000000075161000-memory.dmp

Filesize
900KB

Download
memory/3496-3-0x0000000074F70000-0x0000000074FB8000-memory.dmp

Filesize
288KB

Download