d7d47aa5796cad499374b284e865f715e7496efca16566add1c3a505730259de

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 06:48

Target

$APPDATA/KuaiKuai/KKGame/download/libcurl.dll
Size

260KB
MD5

36fb612db1972a04c0d47b73131e4df7
SHA1

449a6f790508f67691a84e085e9c511c5e561fbf
SHA256

9cadf15983c728391f6a19c41c7d3088b31f7cdd0db5811dfa4a4ad9e409d2cc
SHA512

e3bc4f2e9316275d75baf1058ec24705ab25a7478fe8810224e80d4d9ec73ea952435cb61401e62711c4e6406ef6c7596abeb38087f9ff32fd82068504385909
SSDEEP

6144:zUteKmRYuUBbfkFWpARKOAEYfKr1UF0Mtr:zUtmRBIwWOR/AE96F0W

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	2356	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2356	2088	rundll32.exe	28
PID 2088 wrote to memory of 2356	2088	rundll32.exe	28
PID 2088 wrote to memory of 2356	2088	rundll32.exe	28
PID 2088 wrote to memory of 2356	2088	rundll32.exe	28
PID 2088 wrote to memory of 2356	2088	rundll32.exe	28
PID 2088 wrote to memory of 2356	2088	rundll32.exe	28
PID 2088 wrote to memory of 2356	2088	rundll32.exe	28
PID 2356 wrote to memory of 1932	2356	rundll32.exe	29
PID 2356 wrote to memory of 1932	2356	rundll32.exe	29
PID 2356 wrote to memory of 1932	2356	rundll32.exe	29
PID 2356 wrote to memory of 1932	2356	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\KuaiKuai\KKGame\download\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\KuaiKuai\KKGame\download\libcurl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 232
    3⤵
    - Program crash
    PID:1932