501e5f1a1def69055a403df2277c56a0af9fe87d10b01a95612b1491f982a4a2 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/11/2024, 18:43

Sharing

Report Analysis Logs

General

Target

Crypter Cracked/libcrypto-1_1.dll
Size

3.3MB
MD5

ab01c808bed8164133e5279595437d3d
SHA1

0f512756a8db22576ec2e20cf0cafec7786fb12b
SHA256

9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA512

4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
SSDEEP

98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2108	2728	rundll32.exe	31
PID 2728 wrote to memory of 2108	2728	rundll32.exe	31
PID 2728 wrote to memory of 2108	2728	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crypter Cracked\libcrypto-1_1.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2728 -s 104
  2⤵
  PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads