e66d33caff1a5048e4a5b05e52de6b92957aadd9663265afe495965f9769a725 | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$_2_/libcurl.dll
Size

312KB
MD5

7e650633115b91cda37ee68d26a6e3de
SHA1

035e389e71917f669a2419503fb8f6cf1d7dd583
SHA256

2cbc4df11be6677e7ae13c2196cfac689d67dd67235e0c5575221cc710f9a5f6
SHA512

55ee0db718fc500ac99a07c82b01e87d0a61f5cf10f292abfee71b7f6601265c93c939865e4b764dfc3804cf1fe86437a6bdafeee1a646f45b4127c39719a371
SSDEEP

6144:vXtxmxRsrnAnD1mq5pHkm5hb/CO/zNLSDlJeRACl/t8HsC3:vXtx+RsqQq5pHzb/CO/N0lAY

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1924	2092	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2092	1932	rundll32.exe	28
PID 1932 wrote to memory of 2092	1932	rundll32.exe	28
PID 1932 wrote to memory of 2092	1932	rundll32.exe	28
PID 1932 wrote to memory of 2092	1932	rundll32.exe	28
PID 1932 wrote to memory of 2092	1932	rundll32.exe	28
PID 1932 wrote to memory of 2092	1932	rundll32.exe	28
PID 1932 wrote to memory of 2092	1932	rundll32.exe	28
PID 2092 wrote to memory of 1924	2092	rundll32.exe	29
PID 2092 wrote to memory of 1924	2092	rundll32.exe	29
PID 2092 wrote to memory of 1924	2092	rundll32.exe	29
PID 2092 wrote to memory of 1924	2092	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\libcurl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 228
    3⤵
    - Program crash
    PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads