e3d44a5dbe4a4d2f6a20006499541c5907502b14723acc3ce4e07c3a6e3aedc7

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 20:00

Target

bin/libcrypto-1_1-x64.dll
Size

3.3MB
MD5

3390d76a13973bd46b512bf257c171c8
SHA1

cd269f1f752c272e3868b4dd6dc65464715ae0b0
SHA256

deb034588ef43db62809cc2c599374894bf7fef5df990da6eaaa0674fbec0301
SHA512

8d714e4859ffe4beb2c6a499b4d62cd549679411b5af2b50ec4f75e522e7af1943c4c29cc5d4266409351c596c6a0bb470e4ec0301e23425191f059752458620
SSDEEP

49152:cVwASOC3IU6ixBGtlqREzGbOggxFSAnVJcjp15QAMa4OHjbtNPA6UsQ0H1CPwDvF:l4+0SgbhVUsIjJW6UsB1CPwDv3uFfJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2492 wrote to memory of 1748	2492	rundll32.exe	WerFault.exe
PID 2492 wrote to memory of 1748	2492	rundll32.exe	WerFault.exe
PID 2492 wrote to memory of 1748	2492	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\libcrypto-1_1-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2492 -s 104
  2⤵
  PID:1748