4eaeeda72c1352264f13d2ceea4d43306d5f175f0d3c37979f9fb0fd60c553ee

Analysis

max time kernel
448s
max time network
1170s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
12/05/2024, 07:57

Target
libcrypto-1_1.dll
Size 2.0MB
Sample240512-jtkd2aag78
SHA256 81e7e8206cf46c7aa3abb69a2a2dac8371bf5eea137df1901a84a5b7388fe768
MD5 6f52970d7a41141d3c93b3937bd6b84c
SHA1 bd94dcb31ff9e64b187af8f2361ec688bf5bb91d
SHA512 71b8da11ddb181a1864ca83e4a2d9a5e13948c372d7ea2d4fb5bb5e0acf957c039bd5456ad16c08dd2e18ef252ee492b01c84ecf748afdb616d5496faeca4437
SSDEEP 49152:T6kvSjcvQ/qpyr0kou74WAdvHoU6U1CPwDv3uFV0cSWPWb:2kvCcvQ/qpyr0koW6oUh1CPwDv3uFV0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	3044	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 3044	4960	rundll32.exe	81
PID 4960 wrote to memory of 3044	4960	rundll32.exe	81
PID 4960 wrote to memory of 3044	4960	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcrypto-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcrypto-1_1.dll,#1
  2⤵
  PID:3044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 492
    3⤵
    - Program crash
    PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3044 -ip 3044
1⤵
PID:2916