a22a44a51120148f412a609156342d8e2f0116308ba7ef7a1481c8e52cae319c

Analysis

max time kernel
147s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 17:41

Target

ssleay32.dll
Size

349KB
MD5

cf2c57dda3766c204c398430da23693d
SHA1

9938cbf4b5e7cffa0d73825a6ef85b0d90a0ce0a
SHA256

492f045643354c8b9fa11673b6c32cdbb33779826a729ce55de5901279c1f6d5
SHA512

e83e33b5bc9161351daaaae8e9130d83568d85b4a4ab190730e9558ddad199091f5b3acb3e1060dad5ec840a74f8b6781a086f49b7a1ecb6f82fc1cc265c536a
SSDEEP

6144:VaMcchXvecgMuZESAp8EQS59KrZ6K8KzNvNq4O7D9kU+yQ/ACLO6B5dMeYjByVFI:Va8XvecgMuZESAp85S59KrL8KzNFqx7x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4616 wrote to memory of 4772	4616	rundll32.exe	rundll32.exe
PID 4616 wrote to memory of 4772	4616	rundll32.exe	rundll32.exe
PID 4616 wrote to memory of 4772	4616	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
1⤵
PID:4772

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4616