7a39caf04d025428d5d9e5098fef74e22f59eee2c3686f676e235ae954b18b6d

Resubmissions

10/02/2025, 02:06

10/02/2025, 02:04

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/02/2025, 02:04

Target

libcrypto-1_1-x64.dll
Size

3.3MB
MD5

5bbead1078ba0b07e0766eb2426167eb
SHA1

c3443ea0a003268c022225e9b85c6edfb2c09607
SHA256

0cfa2871aa30c9e047a8f5266b31f548b343f15244d26be26bb2a070b5655237
SHA512

55b98d8b57bf06ff9718a73dffb11a3c666c2ba24964b8a9b3c540d4faa22e3aa5dd284795b97375edeb845b7b83dca89bcc97d44c2f66886d5c5b56ff532902
SSDEEP

49152:aVwASOxVIU6ix4GtlqcD+edG2uGAxq+qJhT/XtJl7Ec6YBE6yPBsosKL1CPwDv3G:0y+/rA0lBvKsosQ1CPwDv3uFh+2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2776	2748	rundll32.exe	31
PID 2748 wrote to memory of 2776	2748	rundll32.exe	31
PID 2748 wrote to memory of 2776	2748	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcrypto-1_1-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2748 -s 104
  2⤵
  PID:2776