01331b4e2b83cff51879d394feefba66eb9b32cd3040c961379edf04f517235a | Triage

Analysis

max time kernel
125s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 01:04

Sharing

Report Analysis Logs

General

Target

libeay32.dll
Size

1.2MB
MD5

161579b703fb4a30674642d65504d54f
SHA1

a825295347e31eaa2ae27c7ad2ec20fed0e75b3d
SHA256

7d533ae5a26d51fead61f66fbaa01e90cae65bbf550d279631add10a43bad4f7
SHA512

94a01fb2b42cd2bdc38354f4f4dfbbb33eade60ec6b3695e6e21df9891b6ac9a421274c6de4ea93257050a1778db2f6bdecaedfd3c7937c6d087c1751a54762f
SSDEEP

24576:V0PE7+KpPA9xxo1baZprVWAXhE1M7dqLhOuu1iK71VpoeVVrK5d:jGRZ37K1M7dqdOKKBVposVm5d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 3908	4736	rundll32.exe	92
PID 4736 wrote to memory of 3908	4736	rundll32.exe	92
PID 4736 wrote to memory of 3908	4736	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
  2⤵
  PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4088,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
1⤵
PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads