a6e797d1c8b081d7ce41f777a744eaf4ef15a9d574eec33cad4296c4c04560ee

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 20:58

Target

libeay32.dll
Size

482KB
MD5

c2703965b8ba0ecf8c5d8a043976facc
SHA1

c578c694d4fe5c15acc3b7aa60e9874d0ded3d54
SHA256

e28e34fbdaff077669586dcdb4e10f0ba2ca6c9973ed4d372a5c3ec3b8ad20e7
SHA512

cb729665206594928a90b29e5c7592120345e92a605122ec6aea564250c4d5d48e1d39c8803820eccde7920aa4d9af99fb3748671de076476d833710b9491d61
SSDEEP

6144:GyAl+J4uce42ylALXYsGB9ZaPEZ3ahnZHFiZlfK/d77ycLFG4683UyS7zooSQQ1z:1Al5SbK0E4Z0EE413UyyzooSTVL

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/640-0-0x0000000010000000-0x0000000010149000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 640	2172	rundll32.exe	83
PID 2172 wrote to memory of 640	2172	rundll32.exe	83
PID 2172 wrote to memory of 640	2172	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
  2⤵
  PID:640

memory/640-0-0x0000000010000000-0x0000000010149000-memory.dmp

Filesize
1.3MB

Download