352873bd27f5760060ff629a73dd0f68b93df978f2e5ee58f52373fe31c1d2af

Analysis

max time kernel
301s
max time network
355s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12/01/2023, 16:24

Target

Drivers/ICLS/lib/libcrypto-1_1-x64.dll
Size

2.9MB
MD5

94ff3487c8343db34daa7837cbd2f5bc
SHA1

71cc8d7c67f784f7aeecae7ca8cac8e1bfa27bb0
SHA256

3bb4784f684c2fb32986c54fc708d705623ef6f6840e33e092805a77475a2d8e
SHA512

aeb554fe2276ca7f9c342d6eba1216b30781a6d61f04dcbd23b8679ab74a1bbd999cef615767d6461dc3148eb3c9193aea73aa5ff4e34ca88cc918219ba5e89b
SSDEEP

49152:IdHNzzMNaMC67G7y0tmwkAKt5GoNPD5sL01CPwDv3uFfJA:6MN3PhGoV5sQ1CPwDv3uFfJA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
944	2012	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 944	2012	rundll32.exe	27
PID 2012 wrote to memory of 944	2012	rundll32.exe	27
PID 2012 wrote to memory of 944	2012	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Drivers\ICLS\lib\libcrypto-1_1-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2012 -s 100
  2⤵
  - Program crash
  PID:944