bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 08:31

Target

MedicareSign/libcrypto1_1.dll
Size

3.0MB
MD5

df54355a82c6ce8fdfc02e1b227410ab
SHA1

2e9134150f83eda3a55b7dd73d5faf6bfa9de132
SHA256

06d30d8a77bf336c16d50a9c9fbf64dccdda5f4e1f6146f7741cecd5492031d3
SHA512

29b0c47dee5a8397b3e4f4e322fed2be60937817a9bc931ba77885bbc2f196bc492cceed8f6eb2706ff4c69c3fdf0a01d2682e2c5d0ec05af21511f3af5b5aad
SSDEEP

49152:6DDCRZw6OzFGE9DtvleF81Zs1CPwDv3uFfJ9LCA4+LObwSH:6DDMZcGE9DbeF8s1CPwDv3uFfJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4968	4696	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 4696	1480	rundll32.exe	84
PID 1480 wrote to memory of 4696	1480	rundll32.exe	84
PID 1480 wrote to memory of 4696	1480	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libcrypto1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libcrypto1_1.dll,#1
  2⤵
  PID:4696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 624
    3⤵
    - Program crash
    PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4696 -ip 4696
1⤵
PID:4240