024d4f4c51543c7511bf843e08d541b182116cac397d2755d11938975c5be6d5

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 14:21

Target

_ssl.dll
Size

484KB
MD5

43985f937c1293f816ddc3756563d553
SHA1

f04fda91978aa4b7d3593fd7b4f67fb2402249a3
SHA256

1585b57a61790936e17c3b2fcccf7bf023149288f616c3ab463c973c4cea7db9
SHA512

db1fa7f5f837aefe0aad92f023ae32f87de1186da26467afb3ea6d9ed915161d77a54f6fd43f5bc78aa33240dc39217e3519816ad89652dfecb648091b8f7ee9
SSDEEP

6144:yBblt0N5Sfif6nI2GwApImElc/nxkL4RrKvYBDA45830XzIgXWzkIKtLs/u/ypGz:Y0jz29mqaxR3B04KJ46psTwR5o

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	2968	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2968	2796	rundll32.exe	27
PID 2796 wrote to memory of 2968	2796	rundll32.exe	27
PID 2796 wrote to memory of 2968	2796	rundll32.exe	27
PID 2796 wrote to memory of 2968	2796	rundll32.exe	27
PID 2796 wrote to memory of 2968	2796	rundll32.exe	27
PID 2796 wrote to memory of 2968	2796	rundll32.exe	27
PID 2796 wrote to memory of 2968	2796	rundll32.exe	27
PID 2968 wrote to memory of 2964	2968	rundll32.exe	28
PID 2968 wrote to memory of 2964	2968	rundll32.exe	28
PID 2968 wrote to memory of 2964	2968	rundll32.exe	28
PID 2968 wrote to memory of 2964	2968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_ssl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_ssl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 296
    3⤵
    - Program crash
    PID:2964