bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:31

Target

MedicareSign/libcrypto1_1.dll
Size

3.0MB
MD5

df54355a82c6ce8fdfc02e1b227410ab
SHA1

2e9134150f83eda3a55b7dd73d5faf6bfa9de132
SHA256

06d30d8a77bf336c16d50a9c9fbf64dccdda5f4e1f6146f7741cecd5492031d3
SHA512

29b0c47dee5a8397b3e4f4e322fed2be60937817a9bc931ba77885bbc2f196bc492cceed8f6eb2706ff4c69c3fdf0a01d2682e2c5d0ec05af21511f3af5b5aad
SSDEEP

49152:6DDCRZw6OzFGE9DtvleF81Zs1CPwDv3uFfJ9LCA4+LObwSH:6DDMZcGE9DbeF8s1CPwDv3uFfJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	2080	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31
PID 2032 wrote to memory of 2080	2032	rundll32.exe	31
PID 2080 wrote to memory of 2084	2080	rundll32.exe	32
PID 2080 wrote to memory of 2084	2080	rundll32.exe	32
PID 2080 wrote to memory of 2084	2080	rundll32.exe	32
PID 2080 wrote to memory of 2084	2080	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libcrypto1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libcrypto1_1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 220
    3⤵
    - Program crash
    PID:2084