308d07fa6ea5a3e88f7bbdcbc5d7df86efb1c39c6736ab16059d88046c99933f | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-en-20211208
submitted
14-12-2021 08:15

Sharing

Report Analysis Logs

General

Target

ssleay32.dll
Size

328KB
MD5

a71bb55be452a69f69a67df2fe7c4097
SHA1

d2ab6d7acf2647827155d9bd3d9d4eca57eb2fce
SHA256

ff6c7f1c9dcff3b3a90cf57a9b4341dda0d76adb9e8667b4a3f75e15a2b7a832
SHA512

d0f7342266d9f9fa34b47564181a169dcf3fb518406f418bf0622c0e1ed5d849fa4c7816c0fe1542fc41e266bf3182ed2ffa49ac8247054a0b60f96b2ba4661a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1756 wrote to memory of 1548	1756	rundll32.exe	27
PID 1756 wrote to memory of 1548	1756	rundll32.exe	27
PID 1756 wrote to memory of 1548	1756	rundll32.exe	27
PID 1756 wrote to memory of 1548	1756	rundll32.exe	27
PID 1756 wrote to memory of 1548	1756	rundll32.exe	27
PID 1756 wrote to memory of 1548	1756	rundll32.exe	27
PID 1756 wrote to memory of 1548	1756	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
  2⤵
  PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-54-0x0000000000000000-mapping.dmp

Download
memory/1548-55-0x0000000076451000-0x0000000076453000-memory.dmp

Filesize
8KB

Download