b06842757fdca6faf5f5509093fc50ee620e0f183882438221e27acae4d9e33f | Triage

Analysis

max time kernel
32s
max time network
4s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 08:38

Sharing

Report Analysis Logs

General

Target

libssl-1_1.dll
Size

518KB
MD5

6464921a380a4aca2966912286a07161
SHA1

bb5b62f6be640aa217c4193e283a1e58d0d0d815
SHA256

194473a59a69e72655015dc582f1e1db7476b598c07cd94839d500e0c7135265
SHA512

b73f4d8897efac5f7d2bc65f32d3d46e54b691c60828fa10605a46c872e3920fd78f17727ff5721fec89d53e6214f07e8002972fe65e502cb0522efc63599fd2
SSDEEP

12288:ZFqet0bGz8AywDH6HkMwFGnsk+iE8QU2lvz5Vwy:ZJObG5jGnwiPQU2lvz5Vwy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 388 wrote to memory of 724	388	rundll32.exe	rundll32.exe
PID 388 wrote to memory of 724	388	rundll32.exe	rundll32.exe
PID 388 wrote to memory of 724	388	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libssl-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:388

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libssl-1_1.dll,#1
2⤵
PID:724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads