bde9aa21edb27047da788869a13e5f81f6fc8beca594f07fb70236dca1a1f139

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 16:51

Target

temp/temp/temp/temp/libcrypto-3-x64.dll
Size

6.1MB
MD5

e7463d58d7aff43c7d71a3847ba8201e
SHA1

1a030443545820af4edea017c64da1233a6177a8
SHA256

2249476a14dea73ae271d661483bdc6c15e45b931f8dbfd0bd1b84193cf420ea
SHA512

2155a8fda32b9cb0f9029ce9fd6b418322b392523bf641b67eb885afc219a9b4942bc37292f32d190f128864b3f5830a8eee44dfc29623689bf0d5b259d0859a
SSDEEP

98304:dP+C5HnwdCqOB1rpZtC78tPq1CPwDvt3uFGCCN:x1HnwNOLpZtC78tC1CPwDvt3uFGCC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2340	2384	rundll32.exe	31
PID 2384 wrote to memory of 2340	2384	rundll32.exe	31
PID 2384 wrote to memory of 2340	2384	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp\temp\temp\temp\libcrypto-3-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2384 -s 88
  2⤵
  PID:2340