cdb19ed186a11c739cb70a09ff8a6432eadd01d0d5f641ff83e17efe2d45683d | Triage

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 22:06

Sharing

Report Analysis Logs

General

Target

sigmaa/libcurl.dll
Size

546KB
MD5

2024156665356070ea193498d076ea7e
SHA1

304fd6c02e788ce55404560e88ecc45d78961d1f
SHA256

815e4160ca9fcf4f6bf2b44b004a35cdb5988103d1204102eb7320ce2146a9bb
SHA512

dec6441fe2fe25e5c2bce8f916d58d3be2bb218f2e82d27e346bce5100caac239c484f4e10f0fdfdc152fda209b066ac04d89b62bdcbe5cfe0393734beb16962
SSDEEP

12288:TIEuXoN7eLmPPIy/KN2nalkLPrEOkTR1VcTo/w4l8DJCLd:EEAoleL2PIyyNrlkLPG1VcTo/w4l8DJs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1840	2612	rundll32.exe	30
PID 2612 wrote to memory of 1840	2612	rundll32.exe	30
PID 2612 wrote to memory of 1840	2612	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sigmaa\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2612 -s 108
  2⤵
  PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads