ff3afd8eb7622bca8ea7fe7eb01daa3d0c93150d2ef0780a3d97ba674390ee97

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 10:53

Target

luyou/libeay32.dll
Size

1003KB
MD5

a1fafdb2ece294fcf38c189671ffe278
SHA1

c36d4e0b7f935a13bfacc223b45d903fe07918eb
SHA256

8535ecd338b1d903e4719370fb432deea80d01c2d95a93d9d22fd7761e519ab8
SHA512

1afe46b1b493dcf86050158e5983ee907eb2899ac1473b44c3f813642e5be4c87b117b5955332aaa21c4104a496deda78e460876a633bf4cbef8888f7aba686b
SSDEEP

12288:5eOiZOSAS01zLiAf1PxLZteyl9T0rWy90g0fqTe1lCArnPFOzXGopS2f4kmbmmE3:VB1PxL+00rWaRmxnNc5p1Hmimn0h

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2980	2968	rundll32.exe	28
PID 2968 wrote to memory of 2980	2968	rundll32.exe	28
PID 2968 wrote to memory of 2980	2968	rundll32.exe	28
PID 2968 wrote to memory of 2980	2968	rundll32.exe	28
PID 2968 wrote to memory of 2980	2968	rundll32.exe	28
PID 2968 wrote to memory of 2980	2968	rundll32.exe	28
PID 2968 wrote to memory of 2980	2968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\libeay32.dll,#1
  2⤵
  PID:2980