d75ecbed0a0bfea3a71dde0aed0958e5d98e2890d520532a09a4e5321d7d680a | Triage

Analysis

max time kernel
1608s
max time network
1612s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
07-07-2023 07:29

Sharing

Report Analysis Logs

General

Target

libssl-1_1.dll
Size

523KB
MD5

46c50a365a8a11627137ad52e4ab2f94
SHA1

6d02dc794a756c077233f074bd85c4b8241c24df
SHA256

187b33ab7a95d4722ff7dc6e2a0e6f121f68fd034b708a946b76748ec2a39b83
SHA512

3e2bdb912e77c249950d3dac3d3937d716e982fa9dfa3aeb48760219e53e99e70292294cc80992095bb18ee62329aac69c253dea2ae6037c9e80e1500a32b1c0
SSDEEP

12288:gypyeH2O8Dkmb4yjpesKWjy/MMk+cdU2lvzAE:lceHp5PIQMT+aU2lvzAE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2372 wrote to memory of 668	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 668	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 668	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 668	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 668	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 668	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 668	2372	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libssl-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libssl-1_1.dll,#1
2⤵
PID:668

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...