b6073a335b57ff3ba40ee7c74c5b429d135202cbbddd9c04564e542951049a8b | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 13:42

Sharing

Report Analysis Logs

General

Target

libeay32.dll
Size

676KB
MD5

c1b41ce18f8065a5b0ce66a4fba48794
SHA1

1ee5afc40dc923bf6343618b50b445ba048bf60d
SHA256

3b6cfd63d6489e5c7358a0ab5075231f843adbde7f9a3379d8af2d8b9e101322
SHA512

f5d9d3ba13daa665f99922d9b05b9acdc947f3be1236938960b3ccc8c3be3c3b14d8ef909b5156df4f55b9a6644409170b62f891459d3bb4d6be7868aa571b8e
SSDEEP

12288:j2jP7x8UgdMuSlzMKcUE0vUTbuv8ph76BG95I2:j2jP7OPdMuSlYKcUvvSbi8nb95x

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2500	2092	rundll32.exe	30
PID 2092 wrote to memory of 2500	2092	rundll32.exe	30
PID 2092 wrote to memory of 2500	2092	rundll32.exe	30
PID 2092 wrote to memory of 2500	2092	rundll32.exe	30
PID 2092 wrote to memory of 2500	2092	rundll32.exe	30
PID 2092 wrote to memory of 2500	2092	rundll32.exe	30
PID 2092 wrote to memory of 2500	2092	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libeay32.dll,#1
  2⤵
  PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads