d2fc1583538a5b41a0f4ea02b03e099ae95e5df7a55bf9b57c4246b21392d389

Analysis

max time kernel
1563s
max time network
1563s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 04:21

Target

Hugo Proxy/libcrypto-3-x64.dll
Size

4.3MB
MD5

b6193aea589adc707aa0945bb925e535
SHA1

68e38599c8dfae7f062634dd96a3663f42b0edc7
SHA256

04c8a659ce80849be4812631b8115f6899cd73ad7f8e77b8b4b6761254125ded
SHA512

b9ffef8401d577ba016b455776acc2052b40ae3edc7171234714d0f907dc760e1f1b07f56c68affd667ed5ebd277989f9800a67b2fa7c943bc9aa72f3cd86391
SSDEEP

98304:vQ+lMO3/Okk/b2hp75brhPZLi1CPwDvt3uF+DCR:oZY/OkNhp75brhRLi1CPwDvt3uF+DCR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2036	2848	rundll32.exe	28
PID 2848 wrote to memory of 2036	2848	rundll32.exe	28
PID 2848 wrote to memory of 2036	2848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Hugo Proxy\libcrypto-3-x64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2848 -s 104
  2⤵
  PID:2036