5ea92cd1af34a0faf1293afa648e3e1e610d89deaf663b4a75a38fbf03ba99dc | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:19

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/libcurl_x86.dll
Size

1.9MB
MD5

7b61b308a44540f9832b00c4a9d6919f
SHA1

3b0fb6be61fe3dd36a90b787dc0df36d5e64a400
SHA256

0e3ed2064e425a79c5375be166446b3e0698710fd27e1bedd47f3f1558631cee
SHA512

12a8c8d31ebb299a9e5938bf6ef901d4afae8b36bae11a3065c38aca98cb1384c03e6384c32e63f96e7122685e579670bad97e02ddf1cb806c1225b5da7747b8
SSDEEP

49152:2KNRWsevHiD2PUPYd/K0Zq9KyQmyrq7eOP2uQqfbwo:2KNRWse/iD2MPYd/NqgJrq7ec

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3000 2896 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 624 wrote to memory of 2896	624	rundll32.exe	rundll32.exe
PID 624 wrote to memory of 2896	624	rundll32.exe	rundll32.exe
PID 624 wrote to memory of 2896	624	rundll32.exe	rundll32.exe
PID 624 wrote to memory of 2896	624	rundll32.exe	rundll32.exe
PID 624 wrote to memory of 2896	624	rundll32.exe	rundll32.exe
PID 624 wrote to memory of 2896	624	rundll32.exe	rundll32.exe
PID 624 wrote to memory of 2896	624	rundll32.exe	rundll32.exe
PID 2896 wrote to memory of 3000	2896	rundll32.exe	WerFault.exe
PID 2896 wrote to memory of 3000	2896	rundll32.exe	WerFault.exe
PID 2896 wrote to memory of 3000	2896	rundll32.exe	WerFault.exe
PID 2896 wrote to memory of 3000	2896	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl_x86.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 228
3⤵
- Program crash
PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads