212689dd6b767a3b00e39654a03b3b8df7d50fdfbb00b139c7a697e4bdf1b6a6

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 16:40

Target

trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/libcurl-4.dll
Size

295KB
MD5

baae54b1157b4c9587cceb4680b13da5
SHA1

939642b482d3e7697cec88d11aebc07bb076c2d1
SHA256

cde6e2b58641afd108ae2606337a71775021127a6109d6d64eadb056ca4598b7
SHA512

433f411f740bb2978a47776fa856874717531985ca3bfbf17cb2f6d1e106585132a7a90ef7b803a10f1293aaad63f2264ee8a8aea2806593d6944e189e0ff813
SSDEEP

6144:wK0GMvBI/QtKUbp9pDKRCzKuGpHTBI9yAR17rRH:wKEvB7Ke9pDXgHTdm7dH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2232	2236	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28
PID 2248 wrote to memory of 2236	2248	rundll32.exe	28
PID 2236 wrote to memory of 2232	2236	rundll32.exe	29
PID 2236 wrote to memory of 2232	2236	rundll32.exe	29
PID 2236 wrote to memory of 2232	2236	rundll32.exe	29
PID 2236 wrote to memory of 2232	2236	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\trichloromethane.exe-Malware-main\trichloromethane\PayloadMBR\Programs\QEMU\libcurl-4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\trichloromethane.exe-Malware-main\trichloromethane\PayloadMBR\Programs\QEMU\libcurl-4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 232
    3⤵
    - Program crash
    PID:2232

memory/2236-0-0x0000000070800000-0x0000000070840000-memory.dmp

Filesize
256KB

Download