aa4ff6b03e2b22f226a68619c989741b347bd5d368572cf2b44de9f26391dab4 | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:29

Sharing

Report Analysis Logs

General

Target

libeay32.dll
Size

1.2MB
MD5

ec31b514b68aa36332262664f9731608
SHA1

09047bc3670d8510177e74962a9d8039942f9ae9
SHA256

6eb24ad19930c168d2b30c449ae36b05cd2ce3b0f82c9617decef92c6e560c10
SHA512

3417e1badf5fe4c7cb5b4e9843918709f2182f19a9b094f7f536000f125660a6239f066587ed6d4c897ff7e0f9646a886123f7a9d5a467421f509be60bea7e39
SSDEEP

24576:bc9S/ssux9hMqgXaoomO1+6SfCY+LaBnBPX7Fp10e2uW2VZoS3tL:JyNgKHmO1+p+Mf7Fp10e2uNVKS3tL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2376	2160	rundll32.exe	28
PID 2160 wrote to memory of 2376	2160	rundll32.exe	28
PID 2160 wrote to memory of 2376	2160	rundll32.exe	28
PID 2160 wrote to memory of 2376	2160	rundll32.exe	28
PID 2160 wrote to memory of 2376	2160	rundll32.exe	28
PID 2160 wrote to memory of 2376	2160	rundll32.exe	28
PID 2160 wrote to memory of 2376	2160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
  2⤵
  PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads