797e52d61827ac81a4528d8ae01e56a96b26941954d644ddfa009a1a6e179fd8

Analysis

max time kernel
147s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2024, 16:52

Target

miflash_unlock-en-6.5.224.28/libeay32.dll
Size

1.3MB
MD5

bebcd31cb3d5ee68adda0cb647da26f5
SHA1

dd4648db6160daab172c288936d266f129236198
SHA256

53702187a1fc82c0d82adde7cd761a4ecb5669e6bfa0a99911c6f33fdba83428
SHA512

eefe96c979141a04681655bf08011b8b21139dade2362bc22fb91dd047d86555750f49dd5e2e028851f86b43e6378b822f16b0728f8c76064a9b0937cb1233cf
SSDEEP

24576:dngMBloPD0jUv3p92wlI5tolDQX4kREQNeRPyVUFU/288:dlkj27IDQ4k/NeRPyVUS/288

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 4168	2708	rundll32.exe	80
PID 2708 wrote to memory of 4168	2708	rundll32.exe	80
PID 2708 wrote to memory of 4168	2708	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\libeay32.dll,#1
  2⤵
  PID:4168