5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
88s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
13/01/2024, 04:57

Target
ovpn/libssl-1_1.dll
Size 924KB
Sample240113-fla9lscdgl
SHA256 89d49df485a5c33f0ebef4a78f6ceb63e60c08113fe21a911cd2c196bf9393fd
MD5 d6d65e0a4a7706a90e328578251f43ae
SHA1 5a34a15fd21f345b3f6c1876df3503e0050e7428
SHA512 2f524f1f9281a643ca3dd657e8136828fbb4c58b259c717bd05ea964379ad814fabd9e47d129ff1866dd92e8d5cadbce38b66c8daf2aba944c57368e7c1d8273
SSDEEP 24576:jN/UGlfUX71WzUoh53Xbj9Vku1UYaN4vlMAUBYSwF/mbsgEKQG7iiHh7xqwg:x/61Wz3534u1UYaWvlMAUuSwF/mbsgpc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 1972	3952	rundll32.exe	16
PID 3952 wrote to memory of 1972	3952	rundll32.exe	16
PID 3952 wrote to memory of 1972	3952	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libssl-1_1.dll,#1
1⤵
PID:1972

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libssl-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3952

memory/1972-0-0x0000000074800000-0x0000000074ABE000-memory.dmp

Download

memory/1972-1-0x0000000074800000-0x0000000074ABE000-memory.dmp

Download