965faa9d136d712e2a5008849ebee26b11a375a8d6b1e7fce72c9b730afba375 | Triage

Analysis

max time kernel
80s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 13:30

Sharing

Report Analysis Logs

General

Target

libcrypto-3.dll
Size

4.9MB
MD5

51e8a5281c2092e45d8c97fbdbf39560
SHA1

c499c810ed83aaadce3b267807e593ec6b121211
SHA256

2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
SHA512

98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP

98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2860	1508	rundll32.exe	31
PID 1508 wrote to memory of 2860	1508	rundll32.exe	31
PID 1508 wrote to memory of 2860	1508	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcrypto-3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1508 -s 104
  2⤵
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads