e7490d25eb3e1553ec66c42b1474a2ff025072f3017eb882f7b15da0379ce9e0

Analysis

max time kernel
1726s
max time network
1158s
platform
windows10-2004_x64
resource
win10v2004-20240221-uk
resource tags

arch:x64arch:x86image:win10v2004-20240221-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
25-02-2024 20:41

Target

$PLUGINSDIR/libssl-3.dll
Size

685KB
MD5

440a0f750f770676aeac4de35fd88637
SHA1

936ff5cefb86ca17e35debb31d76c9d3cb5f3022
SHA256

1515c8560dda68c87b0e0de7330d0b7b517b8fe2a89adcfe9922a7301fff4bf0
SHA512

858689b3931581874e1dc57accedcb46aa12f1339f003b7abf3b9c657bc6b768c7ead01a60244daa13029e41a24dde87a35baee59110072172ef1c8dcb0ec2ad
SSDEEP

12288:Zc1kFuLKdCNCiSHQtRoqHQqkAEPZPIoQjzY6TpmM8wewqgkLc6WwJuA:A2dYCiSeVH1Lww/qgkLc6WwMA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4108 wrote to memory of 4716	4108	rundll32.exe	rundll32.exe
PID 4108 wrote to memory of 4716	4108	rundll32.exe	rundll32.exe
PID 4108 wrote to memory of 4716	4108	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libssl-3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\libssl-3.dll,#1
2⤵
PID:4716