c9ff34cb7d2374891dbd649a3bbaee384e41736818754dd6ba836df250bf8a74 | Triage

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:26

Sharing

Report Analysis Logs

General

Target

libcrypto-3-x64.dll
Size

4.5MB
MD5

a9c1f7ca15c65c139bc9d4bf57df2e1e
SHA1

1b1377139a6b289d43a6b1161cd1089ffc817cf9
SHA256

03ec9292dcdfda520638490e11baeefff5ab1b6eb22feb90a22fc771272ce116
SHA512

97f8745dba6330c196de9b822638bfe7f74a86bdcb6726f4bd1d3d917de54f9abcb05163c42255173eac3bde995f0d611af718dbcc0de432b67666bed0c0b073
SSDEEP

98304:Ml+f+K26t8Te5zUeP4xA1CPwDvt3uFGCCQ:4Ctt8Te5zUewxA1CPwDvt3uFGCC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1996	2544	rundll32.exe	29
PID 2544 wrote to memory of 1996	2544	rundll32.exe	29
PID 2544 wrote to memory of 1996	2544	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcrypto-3-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2544 -s 88
  2⤵
  PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads