5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324

Analysis

max time kernel
1781s
max time network
1803s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2024, 20:34

Target

openvpn/lzo2.dll
Size

88KB
MD5

ca9eb74eb97d9cb38851822a7b7b26ba
SHA1

9c928b28329b86f8d1b0e38f53a4f71dac46c2a4
SHA256

915bf213b676f0af1d2400dd9b1667c6ee271cf989e6cf6237e31b85d326b39e
SHA512

f63ab3aa5845425b4ed157c4aa8f3a7d366d6a61f2299db69fe56b9f9017903db891c414d2f963bf61cf97c9362ad3595c1f207d63a7d4eb2abc70f59169c5a4
SSDEEP

768:NM3RrJeXc4fkCewUUi+iT3h5rJBUjN7QMeXd/WGB3ivxSuJf2gBIfNdFfD/ertN2:NM36kCewU5Tjh/CFQfN/W9vE2vuxerZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2012	2416	rundll32.exe	94
PID 2416 wrote to memory of 2012	2416	rundll32.exe	94
PID 2416 wrote to memory of 2012	2416	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\lzo2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\lzo2.dll,#1
  2⤵
  PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,7064649017625232947,17746804975634116675,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:8
1⤵
PID:5068