e7490d25eb3e1553ec66c42b1474a2ff025072f3017eb882f7b15da0379ce9e0 | Triage

Analysis

max time kernel
1685s
max time network
1179s
platform
windows10-2004_x64
resource
win10v2004-20240221-uk
resource tags

arch:x64arch:x86image:win10v2004-20240221-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
25-02-2024 20:41

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/libssl-1_1.dll
Size

522KB
MD5

e3f1a7c6d1c185835ceeb3bdf37f9562
SHA1

ec4b2af33f67f71042c6db751c151fe3c3d56897
SHA256

4630af7d655a93784e5669be594a0e7ae534d4626e71c1e6acefa722d34a1117
SHA512

b760dedc74bdfe61f5160cc1bb635b6e972846d190408a4e25078f5295adb286a04faa4dc646f543fbc7729b84f0e27fe2809a3b79ceb058579524250ba1858f
SSDEEP

12288:XhMtMk0K+ywPBFNSpfvBKA2FSbU2lvza:xMapS9Q1FSU2lvza

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2584 wrote to memory of 1768	2584	rundll32.exe	rundll32.exe
PID 2584 wrote to memory of 1768	2584	rundll32.exe	rundll32.exe
PID 2584 wrote to memory of 1768	2584	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libssl-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libssl-1_1.dll,#1
2⤵
PID:1768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads