b06842757fdca6faf5f5509093fc50ee620e0f183882438221e27acae4d9e33f | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-04-2024 17:02

Sharing

Report Analysis Logs

General

Target

libssl-1_1.dll
Size

518KB
MD5

6464921a380a4aca2966912286a07161
SHA1

bb5b62f6be640aa217c4193e283a1e58d0d0d815
SHA256

194473a59a69e72655015dc582f1e1db7476b598c07cd94839d500e0c7135265
SHA512

b73f4d8897efac5f7d2bc65f32d3d46e54b691c60828fa10605a46c872e3920fd78f17727ff5721fec89d53e6214f07e8002972fe65e502cb0522efc63599fd2
SSDEEP

12288:ZFqet0bGz8AywDH6HkMwFGnsk+iE8QU2lvz5Vwy:ZJObG5jGnwiPQU2lvz5Vwy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2268 wrote to memory of 1524	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 1524	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 1524	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 1524	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 1524	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 1524	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 1524	2268	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libssl-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libssl-1_1.dll,#1
2⤵
PID:1524

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...