7a39caf04d025428d5d9e5098fef74e22f59eee2c3686f676e235ae954b18b6d | Triage

Resubmissions

10-02-2025 02:06

250210-cjg3laykgq 10

10-02-2025 02:04

250210-chg17syrby 10

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 02:06

Sharing

Report Analysis Logs

General

Target

libcurl.dll
Size

449KB
MD5

f17bbe4b592ef5e2e5563c90aa6e9477
SHA1

836f12ca42b151eda66e542c8f81d965e377e7eb
SHA256

77208031dc7fdae3fc6bd8e2dd7173b740ba8527aa37bfd1774fa16ce26f9290
SHA512

5bbec8fe82bf7a9e719040064e1ad7940e44e81ffb5c7d9f4d320477e4a14050d632c8003a85b081d7923d90722b769c0bf0a602e191389eb1ae318b3a6da4fe
SSDEEP

6144:EPTD6DxLdMoND2/RNMPs00bqRv/suZN/RgbyR/Z79TBtgNS:EPHWxzNi/UzfXBN5mk9TUS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2184	2524	rundll32.exe	30
PID 2524 wrote to memory of 2184	2524	rundll32.exe	30
PID 2524 wrote to memory of 2184	2524	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2524 -s 112
  2⤵
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads