f62712e793e7109552e2cb9c1a57c269be95eb4be1226c5d5ea481229d513ebb | Triage

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 10:33

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/libssl-1_1.dll
Size

522KB
MD5

8dd156f80a2ee55b69a5acde54f8cf9a
SHA1

f3bfb820f699460be1b87e760468c6a0342956d5
SHA256

d320851c4c9070231d76b4643aef40fb070f20c3d11c0947d95b03d83796c4d1
SHA512

a293f0ac8168644bcea58009b23869c17423ccc444c282253beaecf9fef17c2288fa761d4bad39d16a5ccd9f465003a34df3b6438d2e2d3a3fe6125298454d8f
SSDEEP

12288:h82xFH2BOBpepkGP5S1IPkopNFJiU2lvzT9:62xQK1HofF4U2lvzT9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 2012	3100	rundll32.exe	83
PID 3100 wrote to memory of 2012	3100	rundll32.exe	83
PID 3100 wrote to memory of 2012	3100	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libssl-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libssl-1_1.dll,#1
  2⤵
  PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads