729968b92882fba172918f18c7c6246c33e6a4ed7f3b85f8f4eea73aab45c346

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09-12-2024 15:39

Target

bin/libcrypto-1_1-x64.dll
Size

3.3MB
MD5

3390d76a13973bd46b512bf257c171c8
SHA1

cd269f1f752c272e3868b4dd6dc65464715ae0b0
SHA256

deb034588ef43db62809cc2c599374894bf7fef5df990da6eaaa0674fbec0301
SHA512

8d714e4859ffe4beb2c6a499b4d62cd549679411b5af2b50ec4f75e522e7af1943c4c29cc5d4266409351c596c6a0bb470e4ec0301e23425191f059752458620
SSDEEP

49152:cVwASOC3IU6ixBGtlqREzGbOggxFSAnVJcjp15QAMa4OHjbtNPA6UsQ0H1CPwDvF:l4+0SgbhVUsIjJW6UsB1CPwDv3uFfJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2780	2172	rundll32.exe	30
PID 2172 wrote to memory of 2780	2172	rundll32.exe	30
PID 2172 wrote to memory of 2780	2172	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\libcrypto-1_1-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2172 -s 104
  2⤵
  PID:2780