5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
88s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 04:57

Target

ovpn/libssl-1_1.dll
Size

924KB
MD5

d6d65e0a4a7706a90e328578251f43ae
SHA1

5a34a15fd21f345b3f6c1876df3503e0050e7428
SHA256

89d49df485a5c33f0ebef4a78f6ceb63e60c08113fe21a911cd2c196bf9393fd
SHA512

2f524f1f9281a643ca3dd657e8136828fbb4c58b259c717bd05ea964379ad814fabd9e47d129ff1866dd92e8d5cadbce38b66c8daf2aba944c57368e7c1d8273
SSDEEP

24576:jN/UGlfUX71WzUoh53Xbj9Vku1UYaN4vlMAUBYSwF/mbsgEKQG7iiHh7xqwg:x/61Wz3534u1UYaWvlMAUuSwF/mbsgpc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 1972	3952	rundll32.exe	16
PID 3952 wrote to memory of 1972	3952	rundll32.exe	16
PID 3952 wrote to memory of 1972	3952	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libssl-1_1.dll,#1
1⤵
PID:1972

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libssl-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3952

memory/1972-0-0x0000000074800000-0x0000000074ABE000-memory.dmp

Filesize
2.7MB

Download
memory/1972-1-0x0000000074800000-0x0000000074ABE000-memory.dmp

Filesize
2.7MB

Download