cdf7704604f602522cabff38f75509469d80e53cd8f9a716d1c4faa02bd36851

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 01:26

Target

libcrypto-1_1-x64.dll
Size

2.7MB
MD5

28dea3e780552eb5c53b3b9b1f556628
SHA1

55dccd5b30ce0363e8ebdfeb1cca38d1289748b8
SHA256

52415829d85c06df8724a3d3d00c98f12beabf5d6f3cbad919ec8000841a86e8
SHA512

19dfe5f71901e43ea34d257f693ae1a36433dbdbcd7c9440d9b0f9eea24de65c4a8fe332f7b88144e1a719a6ba791c2048b4dd3e5b1ed0fdd4c813603ad35112
SSDEEP

49152:KlOh5PuX2I9Rkf5gnQ7duzGuqFCtLQ2IqNPz38JQ41CPwDv3uFfJ:Q2Irkn2Iqt38C41CPwDv3uFfJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3028 wrote to memory of 3068	3028	rundll32.exe	WerFault.exe
PID 3028 wrote to memory of 3068	3028	rundll32.exe	WerFault.exe
PID 3028 wrote to memory of 3068	3028	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcrypto-1_1-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3028 -s 104
  2⤵
  PID:3068