99c2474f5bea6e3955d1002aa98678c32e9c0e9f2fb6d0c35d3a428ec279d103

Analysis

max time kernel
97s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 04:44

Target

ovpn/libssl-1_1.dll
Size

924KB
MD5

d6d65e0a4a7706a90e328578251f43ae
SHA1

5a34a15fd21f345b3f6c1876df3503e0050e7428
SHA256

89d49df485a5c33f0ebef4a78f6ceb63e60c08113fe21a911cd2c196bf9393fd
SHA512

2f524f1f9281a643ca3dd657e8136828fbb4c58b259c717bd05ea964379ad814fabd9e47d129ff1866dd92e8d5cadbce38b66c8daf2aba944c57368e7c1d8273
SSDEEP

24576:jN/UGlfUX71WzUoh53Xbj9Vku1UYaN4vlMAUBYSwF/mbsgEKQG7iiHh7xqwg:x/61Wz3534u1UYaWvlMAUuSwF/mbsgpc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 4436	2280	rundll32.exe	14
PID 2280 wrote to memory of 4436	2280	rundll32.exe	14
PID 2280 wrote to memory of 4436	2280	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libssl-1_1.dll,#1
1⤵
PID:4436

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libssl-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280

memory/4436-0-0x0000000074EC0000-0x000000007517E000-memory.dmp

Filesize
2.7MB

Download