4acf1581ad3341dac2f665a455ad97b3dfebe4cb71e4d7332dd11fdc908c1f8e | Triage

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:23

Sharing

Report Analysis Logs

General

Target

libeay32.dll
Size

988KB
MD5

97c3b6b4ebddfa7fad3d9aab669b670b
SHA1

ac91e4981def1ae268d4aa1359ee531f277d1aae
SHA256

e7016eabd675a3f26ca362510f110bd7355294bd1c3f54d03b2fc5406a1d4158
SHA512

d6f0c72b8c1549c00ff02661c27fd8389726768f3268739ff1ace60792828bb77e285b489366642e668d2e2e82fd1287a237d69c3d8d34ffdac4a02945a8bb90
SSDEEP

24576:FvAfySqpHPkzO0rCZLG0QdTIuJRpJ2lTCmQ5AqNk:yl28zgZq0kTDRpuCmQOsk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 2540	1480	rundll32.exe	27
PID 1480 wrote to memory of 2540	1480	rundll32.exe	27
PID 1480 wrote to memory of 2540	1480	rundll32.exe	27
PID 1480 wrote to memory of 2540	1480	rundll32.exe	27
PID 1480 wrote to memory of 2540	1480	rundll32.exe	27
PID 1480 wrote to memory of 2540	1480	rundll32.exe	27
PID 1480 wrote to memory of 2540	1480	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
  2⤵
  PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads