b6073a335b57ff3ba40ee7c74c5b429d135202cbbddd9c04564e542951049a8b | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 13:42

Sharing

Report Analysis Logs

General

Target

ssleay32.dll
Size

148KB
MD5

d4c0d211332dec5b8c11899e97f1d27c
SHA1

92e7c1a1defbaaccb38b6653b0b47dd66951dc15
SHA256

4906d6651d4c21e209f6e6ac781c5924ac18facf099f8d3f1a9b5eb9498d7565
SHA512

e1058f9b6bda518fcb10b07ece629e4031d9fd080a0fc3ea67d6a6525f22bf3ddfb4a96e4e5c4394529c98066a95e25050dd756fa9c1da127c3ccf3bb47d81f6
SSDEEP

3072:/nSjDA6rAXagzAgu2EBI4s2ITDL7uvKastW/X:/YVAX3zAguDI12I3gstW/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1084	1156	rundll32.exe	30
PID 1156 wrote to memory of 1084	1156	rundll32.exe	30
PID 1156 wrote to memory of 1084	1156	rundll32.exe	30
PID 1156 wrote to memory of 1084	1156	rundll32.exe	30
PID 1156 wrote to memory of 1084	1156	rundll32.exe	30
PID 1156 wrote to memory of 1084	1156	rundll32.exe	30
PID 1156 wrote to memory of 1084	1156	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
  2⤵
  PID:1084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-0-0x0000000000650000-0x00000000006FB000-memory.dmp

Filesize
684KB

Download