797e52d61827ac81a4528d8ae01e56a96b26941954d644ddfa009a1a6e179fd8 | Triage

Analysis

max time kernel
89s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2024, 16:52

Sharing

Report Analysis Logs

General

Target

miflash_unlock-en-6.5.224.28/ssleay32.dll
Size

348KB
MD5

b5c212c96671fb4eddd46c1522a8665b
SHA1

d1c348b0e4cbd523610edf12ff4855e7da28d625
SHA256

5e75d831b582ac5fcc26768e91b9f9e6b720d01fc52d6127ec71c3843f63d084
SHA512

480a180f919d039e9b78c5a7da7f211e6c42e46aa83845be7263119290ee7ea7e0facd1ffc1717de0460788acb6940f97f3f5b463e25d0ee7e5f280ee3019cc4
SSDEEP

6144:gUZd29qED19vPjep5ymhoYmQPtW0Bt6DYrHlaLT:/2Xb7C5bPg0Bt6tLT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3744	4588	rundll32.exe	77
PID 4588 wrote to memory of 3744	4588	rundll32.exe	77
PID 4588 wrote to memory of 3744	4588	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\ssleay32.dll,#1
  2⤵
  PID:3744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads