bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 08:31

Target

MedicareSign/libssl1_1.dll
Size

925KB
MD5

cbefd9f5e05bbf57aed04b098e6f499f
SHA1

cbac40bfc062e7aa2befcb91687930bab9c4d241
SHA256

e07a95378815fbfc3b2ed21bcae5ba43106a4929273f9bbcc26eff437a3c9ab8
SHA512

3d0c320683e90f66a9b76613cfc84af87422fb5eee2375e918c63642b7e72faa70a6383b6e43e565d6bbeec4c8060062000bd40321165fc4b5ede8b213bda049
SSDEEP

12288:Kzp78vLlddaH+DZA3IYPdpbIMpNL+tJ2m1j0vcY6hb1DG15opdQw1EuDGKXR0DU9:NDHd4hp5p3ohDG15OWk12U2lvzIn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 3788	4468	rundll32.exe	84
PID 4468 wrote to memory of 3788	4468	rundll32.exe	84
PID 4468 wrote to memory of 3788	4468	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libssl1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libssl1_1.dll,#1
  2⤵
  PID:3788