902939d0f0228659a4a02ff426b9e550e5a0ab8499c66e42ee9ea88fc4678ea0

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 20:57

Target

bin/libcrypto-1_1-x64.dll
Size

3.3MB
MD5

3390d76a13973bd46b512bf257c171c8
SHA1

cd269f1f752c272e3868b4dd6dc65464715ae0b0
SHA256

deb034588ef43db62809cc2c599374894bf7fef5df990da6eaaa0674fbec0301
SHA512

8d714e4859ffe4beb2c6a499b4d62cd549679411b5af2b50ec4f75e522e7af1943c4c29cc5d4266409351c596c6a0bb470e4ec0301e23425191f059752458620
SSDEEP

49152:cVwASOC3IU6ixBGtlqREzGbOggxFSAnVJcjp15QAMa4OHjbtNPA6UsQ0H1CPwDvF:l4+0SgbhVUsIjJW6UsB1CPwDv3uFfJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2520 wrote to memory of 2016	2520	rundll32.exe	31
PID 2520 wrote to memory of 2016	2520	rundll32.exe	31
PID 2520 wrote to memory of 2016	2520	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\libcrypto-1_1-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2520 -s 104
  2⤵
  PID:2016