012329ab7790019eb3453f5b33193205d2299802bf34862d9ffef56b2b1d12a0 | Triage

Analysis

max time kernel
136s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:52

Sharing

Report Analysis Logs

General

Target

cgminer-3.7.2-blake/libeay32.dll
Size

1.6MB
MD5

a9f8f35cc2caf8dba7167b91420a680b
SHA1

6fd1de054c228e7d1a515b08377a4b4993e79c4b
SHA256

c7da870ad431d2bac13b40963ee5e7fec8fbc7ca7bc2b40308374ba5149e3651
SHA512

4d92ecd79a87c44ec5a7ff652f726d781c1505f4c73d5f86ae20c512f601df3747d3da244dd57ea4396ed44c69d8587d6567be5f4ae8156bc462b8e9232bb8e2
SSDEEP

49152:kwqSuGMVeZlrWohOGxzF9g4ojLis+x/FJuV2JI:rqSuGMVeZlrWohOGR9oPiRvJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2160 wrote to memory of 4560	2160	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 4560	2160	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 4560	2160	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\libeay32.dll,#1
2⤵
PID:4560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...