bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552 | Triage

Analysis

max time kernel
93s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 08:31

Sharing

Report Analysis Logs

General

Target

MedicareSign/libcurl.dll
Size

534KB
MD5

13cd45df8aaa584ebd2a40ede76f1e06
SHA1

baa19e6a965621cb315e5f866edc179ef1d6b863
SHA256

3ff4e80e327f298a11e116a517be0963a0b3cd376a6a624caffacd586e6b1449
SHA512

285d7265ac05cecdd43650e5def9198b5f2f4d63665739baa059598e41f4ce892248d3ca7e793ac274dc05b4c19cfa11c17faea62fc1e3495c94a03851049328
SSDEEP

12288:DEnhioDz6zv6pmEmE5A8K8ZOO2rKQrbdCPAEI:Dmbz+vomEBHbZO2YCBI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4932	872	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 872	2836	rundll32.exe	86
PID 2836 wrote to memory of 872	2836	rundll32.exe	86
PID 2836 wrote to memory of 872	2836	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libcurl.dll,#1
  2⤵
  PID:872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 636
    3⤵
    - Program crash
    PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 872 -ip 872
1⤵
PID:4752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads