b2f7887ae0bd418724eb32d3449197551a0895f2c764a933a7bd984f187eab78 | Triage

Resubmissions

15/09/2022, 09:13

220915-k63xksced3 1

15/09/2022, 09:10

220915-k4z3xacec5 1

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2022, 09:13

Sharing

Report Analysis Logs

General

Target

libeay32.dll
Size

1.1MB
MD5

320fd1d9fc94e40cedcba3f9cc7aec43
SHA1

38c830cbe05d4ef7a193bbf754a521c8f7a185c5
SHA256

b2f7887ae0bd418724eb32d3449197551a0895f2c764a933a7bd984f187eab78
SHA512

870df08bc60094edab701edafbac0e2d341e500e3d8dc418fadcd138e4cb59225e054f9fb571d35d4217968a16060dae06e7bb0407acbd51181098a486299f35
SSDEEP

24576:PgOa+idPMVjzxbi2p/LajEe5aBpfXNCOK7bQ2mpoODMVIZmp:QUttnuIeQBdXNjKnQ2mpodVCmp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 3576	4700	rundll32.exe	80
PID 4700 wrote to memory of 3576	4700	rundll32.exe	80
PID 4700 wrote to memory of 3576	4700	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
  2⤵
  PID:3576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads