ee02d92c75e47a3ce2e335443749eaeb92c81182ea275d513dea63b923012c73

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
14/01/2023, 13:21

Target

ssleay32.dll
Size

314KB
MD5

31f03f084561d353baea7f37c5d34bbd
SHA1

bc72650c8fc644c7fc1dc2d39fcadb945cd42c9a
SHA256

f14596622f6a8f888a5a4b4ba4be859a918d56ba8eda9e734bd857846f3f99ec
SHA512

7119d01eadf3ba3f536c1baafc9b8c5d777c0d146834cf00ac1c04194cb21fb2b185e23695d4ac40e6dae2d19a777e57d5c7422f7a2f7f31511db29bd8196682
SSDEEP

6144:Ig/W0BFJp0ZniLvWSzhnoi3L1i2C89mbmQM1nJnuoNi4BjVjqFoK0wt2wqTHgJDh:IcBFJp0ZniLvWSzhoi3L1i2C89mbmQMG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1416	1736	rundll32.exe	28
PID 1736 wrote to memory of 1416	1736	rundll32.exe	28
PID 1736 wrote to memory of 1416	1736	rundll32.exe	28
PID 1736 wrote to memory of 1416	1736	rundll32.exe	28
PID 1736 wrote to memory of 1416	1736	rundll32.exe	28
PID 1736 wrote to memory of 1416	1736	rundll32.exe	28
PID 1736 wrote to memory of 1416	1736	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
  2⤵
  PID:1416

memory/1416-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download