0c4b7a3670f4ef5f7ba2d7e820cb3df837a72c08a4d039768b50617c06983308 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-12-2024 21:13

Sharing

Report Analysis Logs

General

Target

libcrypto-3-x64.dll
Size

4.5MB
MD5

dc0b5510731cbf1cb12859b137efedfe
SHA1

4925f0c77fd32cf2f8eab916d00872d0bc9324e2
SHA256

fd92dbc1a720ef43d53a6c3536ab05ccc78b5efe768cc3624d4f7b3cf0d02132
SHA512

1adc1e36445d1125703675b7a47beaef05992a2ef5051a6513973f16dee374bf72085ffb26d502295d1c69283a56578d8bb59b432f9087102c5bb5e93a49ddb4
SSDEEP

98304:wl+kK7ppVSns2jW/aJPr4v1CPwDvt3uFGCC:ME7Xgns2jW/aJT4v1CPwDvt3uFGCC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 596	2156	rundll32.exe	31
PID 2156 wrote to memory of 596	2156	rundll32.exe	31
PID 2156 wrote to memory of 596	2156	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcrypto-3-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2156 -s 88
  2⤵
  PID:596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads