3f1dbdc8075bdf3119c2c5b09541033dfdf4ab035a7896d327e143fdbdc9757a | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 15:42

Sharing

Report Analysis Logs

General

Target

libcrypto-3-x64.dll
Size

4.5MB
MD5

a9c1f7ca15c65c139bc9d4bf57df2e1e
SHA1

1b1377139a6b289d43a6b1161cd1089ffc817cf9
SHA256

03ec9292dcdfda520638490e11baeefff5ab1b6eb22feb90a22fc771272ce116
SHA512

97f8745dba6330c196de9b822638bfe7f74a86bdcb6726f4bd1d3d917de54f9abcb05163c42255173eac3bde995f0d611af718dbcc0de432b67666bed0c0b073
SSDEEP

98304:Ml+f+K26t8Te5zUeP4xA1CPwDvt3uFGCCQ:4Ctt8Te5zUewxA1CPwDvt3uFGCC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 828	2500	rundll32.exe	30
PID 2500 wrote to memory of 828	2500	rundll32.exe	30
PID 2500 wrote to memory of 828	2500	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcrypto-3-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2500 -s 88
  2⤵
  PID:828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads