43abf0007f712220af5a5339aace99fb68929652bcacee4779c2f432220a15c4 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 02:25

Sharing

Report Analysis Logs

General

Target

bin/wolfssl.dll
Size

1.2MB
MD5

a396ee8375252d04da31676fe1b3ff75
SHA1

57aee1e5b69a85d0e0b7d5a103ddb683f0204cce
SHA256

7dc3aeda7518abb376a6932583669e7e1595a656edeae65af1397807322e8a25
SHA512

ff755bed789869a8cc2adc05b7a3b234ef93997b1774cc719d506ce4dd03fcd0ed6d320a13d815e27a21ebdf99f3308ea47a8de6b9a25ca4eaa8fb4045fbb0db
SSDEEP

24576:yoCqsxtqSepCBr5fFrHodqht+tmiw9P9TsdJRV5Wodh8NHmoz:3CzASep0r5fFrHoUht+tU9TsrRV5WodE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2508	1624	rundll32.exe	29
PID 1624 wrote to memory of 2508	1624	rundll32.exe	29
PID 1624 wrote to memory of 2508	1624	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\wolfssl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1624 -s 92
  2⤵
  PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads