a23d677c9e5176d2e98b2dae2c72842a854f4cfab658c38b29ef883831287934 | Triage

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-06-2022 07:48

Sharing

Report Analysis Logs

General

Target

libeay32.dll
Size

482KB
MD5

c2703965b8ba0ecf8c5d8a043976facc
SHA1

c578c694d4fe5c15acc3b7aa60e9874d0ded3d54
SHA256

e28e34fbdaff077669586dcdb4e10f0ba2ca6c9973ed4d372a5c3ec3b8ad20e7
SHA512

cb729665206594928a90b29e5c7592120345e92a605122ec6aea564250c4d5d48e1d39c8803820eccde7920aa4d9af99fb3748671de076476d833710b9491d61

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5020 wrote to memory of 916	5020	rundll32.exe	rundll32.exe
PID 5020 wrote to memory of 916	5020	rundll32.exe	rundll32.exe
PID 5020 wrote to memory of 916	5020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
2⤵
PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-130-0x0000000000000000-mapping.dmp

Download
memory/916-131-0x0000000010000000-0x0000000010149000-memory.dmp

Filesize
1.3MB

Download
memory/916-132-0x0000000010000000-0x0000000010149000-memory.dmp

Filesize
1.3MB

Download