8f4d63fea00eca6d91147de6a10b7aae6069f164ef00d5986eff571249552dae | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 23:21

Sharing

Report Analysis Logs

General

Target

$_1_/libeay32.dll
Size

1.3MB
MD5

4cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1

a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256

a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA512

46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
SSDEEP

24576:VD8B+KpPexB6mqwktXUcAVEaFQXhL0porIqo+Frzba:WKkmlktXUcAVEDhQporIqo+Frzba

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2164 wrote to memory of 2400	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2400	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2400	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2400	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2400	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2400	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2400	2164	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_1_\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_1_\libeay32.dll,#1
  2⤵
  PID:2400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads