8fad9ced8eef4b980c51eca9f5b2b1095b69de9dfe204592ca99782102169c37

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 19:44

Target

bin/libcrypto-1_1-x64.dll
Size

3.3MB
MD5

3390d76a13973bd46b512bf257c171c8
SHA1

cd269f1f752c272e3868b4dd6dc65464715ae0b0
SHA256

deb034588ef43db62809cc2c599374894bf7fef5df990da6eaaa0674fbec0301
SHA512

8d714e4859ffe4beb2c6a499b4d62cd549679411b5af2b50ec4f75e522e7af1943c4c29cc5d4266409351c596c6a0bb470e4ec0301e23425191f059752458620
SSDEEP

49152:cVwASOC3IU6ixBGtlqREzGbOggxFSAnVJcjp15QAMa4OHjbtNPA6UsQ0H1CPwDvF:l4+0SgbhVUsIjJW6UsB1CPwDv3uFfJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2116 wrote to memory of 1488	2116	rundll32.exe	30
PID 2116 wrote to memory of 1488	2116	rundll32.exe	30
PID 2116 wrote to memory of 1488	2116	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\libcrypto-1_1-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2116 -s 104
  2⤵
  PID:1488