7c0f72bad64237b4b2749840811299838e0062bd1551182ac82cae17a7e555bf | Triage

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 14:51

Sharing

Report Analysis Logs

General

Target

refox/libeay32.dll
Size

1.3MB
MD5

04d2df70b1427d4feb14d87b500bed14
SHA1

23d7944a0393d127ec2f33ec9f4bbfcf63cb8616
SHA256

f87e0d2a87c77925b0b42eabb9aa51bd1b07c29b89281ca29e1b47d174bcd1f7
SHA512

bf92e01dee43a15d4a7560de496dadee98049bc1c6d13190f4147b6d876017350f80c8281b97da6c8c23e329e40541e2eb0b4ca01821389cb58f698061319186
SSDEEP

24576:gexkqJNJKNKbmhvZ2eHAKfFmu4potqqNMxYN7N:j5JNJKNKbuvF9dF4poAq2x87N

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1948 wrote to memory of 2304	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2304	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2304	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2304	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2304	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2304	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2304	1948	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\refox\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\refox\libeay32.dll,#1
  2⤵
  PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads