01331b4e2b83cff51879d394feefba66eb9b32cd3040c961379edf04f517235a | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 01:04

Sharing

Report Analysis Logs

General

Target

libeay32.dll
Size

1.2MB
MD5

161579b703fb4a30674642d65504d54f
SHA1

a825295347e31eaa2ae27c7ad2ec20fed0e75b3d
SHA256

7d533ae5a26d51fead61f66fbaa01e90cae65bbf550d279631add10a43bad4f7
SHA512

94a01fb2b42cd2bdc38354f4f4dfbbb33eade60ec6b3695e6e21df9891b6ac9a421274c6de4ea93257050a1778db2f6bdecaedfd3c7937c6d087c1751a54762f
SSDEEP

24576:V0PE7+KpPA9xxo1baZprVWAXhE1M7dqLhOuu1iK71VpoeVVrK5d:jGRZ37K1M7dqdOKKBVposVm5d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1792	2364	rundll32.exe	28
PID 2364 wrote to memory of 1792	2364	rundll32.exe	28
PID 2364 wrote to memory of 1792	2364	rundll32.exe	28
PID 2364 wrote to memory of 1792	2364	rundll32.exe	28
PID 2364 wrote to memory of 1792	2364	rundll32.exe	28
PID 2364 wrote to memory of 1792	2364	rundll32.exe	28
PID 2364 wrote to memory of 1792	2364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
  2⤵
  PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads