f32ebf00a80c573b3343412ddd053c6327b613c489cddf91de113883e5346794 | Triage

Analysis

max time kernel
90s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20240426-fr
resource tags

arch:x64arch:x86image:win11-20240426-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
21-05-2024 16:46

Sharing

Report Analysis Logs

General

Target

libeay32.dll
Size

1.3MB
MD5

bebcd31cb3d5ee68adda0cb647da26f5
SHA1

dd4648db6160daab172c288936d266f129236198
SHA256

53702187a1fc82c0d82adde7cd761a4ecb5669e6bfa0a99911c6f33fdba83428
SHA512

eefe96c979141a04681655bf08011b8b21139dade2362bc22fb91dd047d86555750f49dd5e2e028851f86b43e6378b822f16b0728f8c76064a9b0937cb1233cf
SSDEEP

24576:dngMBloPD0jUv3p92wlI5tolDQX4kREQNeRPyVUFU/288:dlkj27IDQ4k/NeRPyVUS/288

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4776 wrote to memory of 4612	4776	rundll32.exe	rundll32.exe
PID 4776 wrote to memory of 4612	4776	rundll32.exe	rundll32.exe
PID 4776 wrote to memory of 4612	4776	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
2⤵
PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads