7f7e9c4eda4a83d113cc932cbe3ea3df1b73970885492ba441dc07f249ac02a1

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 01:09

Target

ssleay32.dll
Size

328KB
MD5

a71bb55be452a69f69a67df2fe7c4097
SHA1

d2ab6d7acf2647827155d9bd3d9d4eca57eb2fce
SHA256

ff6c7f1c9dcff3b3a90cf57a9b4341dda0d76adb9e8667b4a3f75e15a2b7a832
SHA512

d0f7342266d9f9fa34b47564181a169dcf3fb518406f418bf0622c0e1ed5d849fa4c7816c0fe1542fc41e266bf3182ed2ffa49ac8247054a0b60f96b2ba4661a
SSDEEP

6144:dLO38jiCYCDntquD5aaQn4jQiA/EhNmYDn2J8mZaEZn3WIV/Yx0w1kFvm8ZHValx:ZO38jiCYCDntquDbQn4jQiA/EhNPT2Jy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
  2⤵
  PID:1532