5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324

Analysis

max time kernel
1793s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2024, 20:30

Target

openvpn/ssleay32.dll
Size

232KB
MD5

afaead8eecbc3e59279e110fa24bb381
SHA1

ab075ec3b4eb23c75a801749a21b873a6b68a563
SHA256

86d47b314ce7a2c41e2b1416e2a6a7a25ea75b22473cfe3748611fc6b85fba61
SHA512

9ff014e16aa880b62c3de0962120c565bfbcace0b0ec811981cb4e64d352fa63c35efe27123544f893837a362f9b3264180747031d07517a002c47ff82904a34
SSDEEP

6144:ojyFZOZowisEQKfa1cF0P7gptqd+mm9BlIlVmAANpseSyazWkaWWS4EwjTOhzK8d:ojUOZoBsEQKfaiF0Ytqd+Z9BlInmAANu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4456	2220	rundll32.exe	90
PID 2220 wrote to memory of 4456	2220	rundll32.exe	90
PID 2220 wrote to memory of 4456	2220	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\ssleay32.dll,#1
  2⤵
  PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3488 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4920

memory/4456-0-0x0000000002C20000-0x0000000002D32000-memory.dmp

Filesize
1.1MB

Download