7c5b449226d2c3e8e65341baffb10b9393282d53b7f6fb164ed788ca2967bb99

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 23:59

Target

bin/libcrypto-1_1-x64.dll
Size

3.3MB
MD5

f57fd8bbfab9f786ccb60d663745c864
SHA1

75b50bd80e01650f97119648f6aebfb736b89e99
SHA256

13071dc72a97cf3c84fa754714c99f3b91f3aa784393994401bec0a7869cdb51
SHA512

7fd8b7c323d52188575d6054cbf561a05bbc688d002f8d80a0c0d915a6cfc9537755d520482126dac334e6f08d4519977be5f97ed52964076d8ba992222c92a1
SSDEEP

49152:8VwASOryIU6ifZGtlqQ0Oh5PhTEeJ/nOCH0tpINuZdeKDYRTLaLa4NP6DN8831CB:Y1+4/mtO0a48DN8K1CPwDv3uFfJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 964 wrote to memory of 1424	964	rundll32.exe	WerFault.exe
PID 964 wrote to memory of 1424	964	rundll32.exe	WerFault.exe
PID 964 wrote to memory of 1424	964	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\libcrypto-1_1-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 964 -s 88
2⤵
PID:1424