df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a

Analysis

max time kernel
292s
max time network
332s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 00:18

Target

ssleay32.dll
Size

270KB
MD5

b9cafab9d39548dda98c9013c2450863
SHA1

afada50ab2ec72c4d6e604467cc609fe501aff2c
SHA256

769458c1ca2d45e9f1ad20431e4844fb1e460225aca34312e7ff6e9944a54343
SHA512

4d81a18aa39051e77654334bec770b0d4a55637b143d25a27cc18cbb7a710e181f61565f9fad6606fb7b8f00269d91951eb71ecdc51461d115dc973b6da95289
SSDEEP

6144:v/FSVlx9mOwE8XTbJbxI03WzA6LDjwNqMQG4kWe/vl+zGk8z3svzVdbbjk3ENXvb:HFSVlx9mOwE8XTlbxI03Wk6LDjwNxQGC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 1924	4176	rundll32.exe	95
PID 4176 wrote to memory of 1924	4176	rundll32.exe	95
PID 4176 wrote to memory of 1924	4176	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
  2⤵
  PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3920 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:1664