c1411695a46008567ed81c474298a6cade2e743d50019acb46407ed66cb11b0e

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-02-2025 09:58

Target

libcrypto-1_1-x64.dll
Size

2.6MB
MD5

b595f25fe4d5f2e67f571b765b54c8ce
SHA1

0332cb13db9d48b853e443f8847d6c5012662b56
SHA256

d55dfc9ae0ad2470804f39b7e6a089785837f1e51092ba1b96cec9b9296f6a70
SHA512

e85176f051b437097cc5b8f30db192fd21cb9fd833c520192286c98c9ab2d235bab4dd1526d49d301ec4f275c214871beee5bf8d364e2b5bd5ad7f59a7db9f5f
SSDEEP

49152:MVwAsO4zQ4jLscYK+MY7QFgWMkWCrAIU6i8CR8JI2h4cGgCnXPGtlq5KN/DdFiSA:/QFVQFgWMk/r+8CaI2hebfY/DdFVMcX0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2844	2716	rundll32.exe	30
PID 2716 wrote to memory of 2844	2716	rundll32.exe	30
PID 2716 wrote to memory of 2844	2716	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcrypto-1_1-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2716 -s 88
  2⤵
  PID:2844

memory/2716-0-0x0000000067E00000-0x00000000680AB000-memory.dmp

Filesize
2.7MB

Download