f1160a33fb79c764cdc4c023fa700054ae2945ed91880e37348a17c010ca716f | Triage

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 21:29

Sharing

Report Analysis Logs

General

Target

libssl-3.dll
Size

619KB
MD5

a27d20ccf6ece53d57acf7a3d28e6d11
SHA1

531d5772b11465eba6fbc35e2fd4445b0f392944
SHA256

8f63ad75681d433bd5194ece9b05f61e0834bab1e905edc1ed61af0f96e7baf3
SHA512

3124e9f8a4bddc1ca76e090298be9ed84b8b0509f3c04f3b74193d5e381818bed9ca2b104e531eab6a1940fa6be7878d45636c4b5efdf8ab35bf3b784ae1dd87
SSDEEP

12288:hevei9Y3mICu2Oa7100/QoNtkRLEtPDMWe4rS0US2rpuH/ufB01sQi4:h0ei9UCR0W15UKH/q01sQi4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 5036	432	rundll32.exe	88
PID 432 wrote to memory of 5036	432	rundll32.exe	88
PID 432 wrote to memory of 5036	432	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libssl-3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libssl-3.dll,#1
  2⤵
  PID:5036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads