5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324 | Triage

Analysis

max time kernel
1654s
max time network
1566s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:51

Sharing

Report Analysis Logs

General

Target

libeay32.dll
Size

1.1MB
MD5

320fd1d9fc94e40cedcba3f9cc7aec43
SHA1

38c830cbe05d4ef7a193bbf754a521c8f7a185c5
SHA256

b2f7887ae0bd418724eb32d3449197551a0895f2c764a933a7bd984f187eab78
SHA512

870df08bc60094edab701edafbac0e2d341e500e3d8dc418fadcd138e4cb59225e054f9fb571d35d4217968a16060dae06e7bb0407acbd51181098a486299f35
SSDEEP

24576:PgOa+idPMVjzxbi2p/LajEe5aBpfXNCOK7bQ2mpoODMVIZmp:QUttnuIeQBdXNjKnQ2mpodVCmp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1348 wrote to memory of 4276	1348	rundll32.exe	85
PID 1348 wrote to memory of 4276	1348	rundll32.exe	85
PID 1348 wrote to memory of 4276	1348	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
  2⤵
  PID:4276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads