aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:19

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/libcurl_x86.dll
Size

1.9MB
MD5

7b61b308a44540f9832b00c4a9d6919f
SHA1

3b0fb6be61fe3dd36a90b787dc0df36d5e64a400
SHA256

0e3ed2064e425a79c5375be166446b3e0698710fd27e1bedd47f3f1558631cee
SHA512

12a8c8d31ebb299a9e5938bf6ef901d4afae8b36bae11a3065c38aca98cb1384c03e6384c32e63f96e7122685e579670bad97e02ddf1cb806c1225b5da7747b8
SSDEEP

49152:2KNRWsevHiD2PUPYd/K0Zq9KyQmyrq7eOP2uQqfbwo:2KNRWse/iD2MPYd/NqgJrq7ec

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3008 2996 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2928 wrote to memory of 2996	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2996	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2996	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2996	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2996	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2996	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2996	2928	rundll32.exe	rundll32.exe
PID 2996 wrote to memory of 3008	2996	rundll32.exe	WerFault.exe
PID 2996 wrote to memory of 3008	2996	rundll32.exe	WerFault.exe
PID 2996 wrote to memory of 3008	2996	rundll32.exe	WerFault.exe
PID 2996 wrote to memory of 3008	2996	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcurl_x86.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 228
3⤵
- Program crash
PID:3008

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...