4b60b2960da8862d8ddb07ca1a96302bc591110dc1898a0bc6495e4fbacd56ad

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 19:43

Target

Avernus/Avernus/bin/libcrypto-3-x64.dll
Size

4.5MB
MD5

f9498e2e5be8278782708633650342d0
SHA1

56632f42827d7d65bc10480730b74b6102a8071a
SHA256

be4d803f15b8a200ad2edaa3828dd5f0e6350dd033edd7aeb4cae0dd7f00c531
SHA512

d07c44f05bb2c79a09570288fecef55ea048b797c37ccefa086d21971d0162c4cdacb7e0ec5c5ed2ac7d821150d1fd6a8a7367e7f4c737ce4838c31b005d63ae
SSDEEP

98304:ol+kK7ppAfhvCDuWu2PuOs1CPwDvt3uFGCC:EE7XAfhvCDuWu2mOs1CPwDvt3uFGCC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2384	1452	rundll32.exe	30
PID 1452 wrote to memory of 2384	1452	rundll32.exe	30
PID 1452 wrote to memory of 2384	1452	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Avernus\Avernus\bin\libcrypto-3-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1452 -s 88
  2⤵
  PID:2384