a23d677c9e5176d2e98b2dae2c72842a854f4cfab658c38b29ef883831287934 | Triage

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-06-2022 07:48

Sharing

Report Analysis Logs

General

Target

libeay32.dll
Size

482KB
MD5

c2703965b8ba0ecf8c5d8a043976facc
SHA1

c578c694d4fe5c15acc3b7aa60e9874d0ded3d54
SHA256

e28e34fbdaff077669586dcdb4e10f0ba2ca6c9973ed4d372a5c3ec3b8ad20e7
SHA512

cb729665206594928a90b29e5c7592120345e92a605122ec6aea564250c4d5d48e1d39c8803820eccde7920aa4d9af99fb3748671de076476d833710b9491d61

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 560 wrote to memory of 1936	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 1936	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 1936	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 1936	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 1936	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 1936	560	rundll32.exe	rundll32.exe
PID 560 wrote to memory of 1936	560	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
2⤵
PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-54-0x0000000000000000-mapping.dmp

Download
memory/1936-55-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download