5c28511a37fa39869f2d6fef6f8e9c8e282216823ec401803b649d9b79b84260 | Triage

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 12:54

Sharing

Report Analysis Logs

General

Target

ssleay32.dll
Size

205KB
MD5

88c07e0ba6aa49cbae9958790c30c564
SHA1

aa327f0f7bb6a7a428726553a490c6894be50405
SHA256

157e81c3be64751f8b1b0dfa0b0b32b45d841c71b38392cf807951a5dfe869a8
SHA512

698a99373400406a4cc5115f7d41218cd5e264b2818a6a1742d6ffdfe23f1373bc876dba7d2dc2bc82df76c99fb32291f7ca086d52e1251e49c4a2988c19ad23
SSDEEP

6144:gYZ6fUZmg59YgyIaPxsg0knnWpLtKACG+P7WBpnoF4XBok:gYqUZP9YghaPxbbn0vCG+P7Wu4XCk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 376	3192	rundll32.exe	90
PID 3192 wrote to memory of 376	3192	rundll32.exe	90
PID 3192 wrote to memory of 376	3192	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
  2⤵
  PID:376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/376-0-0x00000000005D0000-0x00000000006CF000-memory.dmp

Filesize
1020KB

Download