64c83e7033b61e8e811ea5c19d446cd2d2d884736386468e37290db8cf0763a6 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 14:25

Sharing

Report Analysis Logs

General

Target

libcurl.dll
Size

656KB
MD5

430ad1a5de13932331ab50f1cb469959
SHA1

66b2058f2c8fddadf87591e742a5bdaf8eb74507
SHA256

67c6fbfb5c0f5a5527415cf36d8e3bb2045d5ef6a3fc29a312911676769f5758
SHA512

768b0d8d724d19cc3e3de09b4b8b9de149b811288ae872c08fcfe9cf223131b31b92a8933fa09552c5fd77b5b312cf47323b99c9b21d73d6fb8cc703cb44145c
SSDEEP

12288:bvArRDjmkqR6tv3cKOuWmDxyEI+mVLIOlwBnq48+EVjt1wIe:bv9ptuWKxyEI+mNIOlenqd+EVxM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1152	1752	rundll32.exe	30
PID 1752 wrote to memory of 1152	1752	rundll32.exe	30
PID 1752 wrote to memory of 1152	1752	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1752 -s 76
  2⤵
  PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads