ee02d92c75e47a3ce2e335443749eaeb92c81182ea275d513dea63b923012c73 | Triage

Analysis

max time kernel
296s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2023, 13:21

Sharing

Report Analysis Logs

General

Target

libeay32.dll
Size

1.2MB
MD5

3c78d0a32d4c4db77084488339ef6be6
SHA1

dbfae391ba3eeaad9dc705d1849208014707537f
SHA256

5b61c124aba34689070c921ec576dec1a741d9e78a12a23a75db60472c333443
SHA512

2483842e0e937180a3c82f6d9a066ffb3091260ac23f1aada8c422d04059f2e6149dbc6ec726b385bbfd1b5282ac30cb076059279515c5bfc81e8072d56ebf14
SSDEEP

24576:dP9+KpPiVmWAwyV/VnKIQ2YJBq2ITZe++7Sa2HeAtPVJJz/mBtA3W:zJWAPHaguqHeAtPLJaBtA3W

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2556	2760	rundll32.exe	81
PID 2760 wrote to memory of 2556	2760	rundll32.exe	81
PID 2760 wrote to memory of 2556	2760	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
  2⤵
  PID:2556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads