e7490d25eb3e1553ec66c42b1474a2ff025072f3017eb882f7b15da0379ce9e0 | Triage

Analysis

max time kernel
1375s
max time network
1173s
platform
windows10-2004_x64
resource
win10v2004-20240221-uk
resource tags

arch:x64arch:x86image:win10v2004-20240221-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
25-02-2024 20:41

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/libcrypto-1_1.dll
Size

2.4MB
MD5

e879fa16f3746a14cd46dbc514452eea
SHA1

ba9559dca54da672a81cfe711004b25259fe8cf4
SHA256

e8a549275b205df98c33d76c47d2476ea57d14ed476d759fc921357a05ab740c
SHA512

274605fc33e77d6e891f070e09a00d65bea4aebd28506d3d4b036cf4436ab29a29fce887f0091080027529f7848b84625fffeb13b7e32d3c5472995da16a6a97
SSDEEP

49152:yOPnkpFc0CvHTStvQRR8uh1CPwDv3uFfJ/stT:yOPCeSWRR821CPwDv3uFfJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1996 4548 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2184 wrote to memory of 4548	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 4548	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 4548	2184	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcrypto-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libcrypto-1_1.dll,#1
2⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 628
3⤵
- Program crash
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4548 -ip 4548
1⤵
PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads