5ea92cd1af34a0faf1293afa648e3e1e610d89deaf663b4a75a38fbf03ba99dc | Triage

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:19

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/libcurl_x86.dll
Size

1.9MB
MD5

7b61b308a44540f9832b00c4a9d6919f
SHA1

3b0fb6be61fe3dd36a90b787dc0df36d5e64a400
SHA256

0e3ed2064e425a79c5375be166446b3e0698710fd27e1bedd47f3f1558631cee
SHA512

12a8c8d31ebb299a9e5938bf6ef901d4afae8b36bae11a3065c38aca98cb1384c03e6384c32e63f96e7122685e579670bad97e02ddf1cb806c1225b5da7747b8
SSDEEP

49152:2KNRWsevHiD2PUPYd/K0Zq9KyQmyrq7eOP2uQqfbwo:2KNRWse/iD2MPYd/NqgJrq7ec

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

844 1788 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 740 wrote to memory of 1788	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1788	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1788	740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl_x86.dll,#1
2⤵
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 636
3⤵
- Program crash
PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1788 -ip 1788
1⤵
PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...