5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324

Analysis

max time kernel
139s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:42

Target

openvpn/libeay32.dll
Size

1.0MB
MD5

ba89664ed643d392d640b62531347e39
SHA1

75c21c451688e6db72dcc9a01b05e3be78663662
SHA256

8dce84eaae874e7c02e4fb9a0a762d27092dfee9d92a8b220138367f2f937957
SHA512

61f182ba2112270800de88bb04039190943fc608060575d895d564ae41ed8f689b8d1b84c155181987b430e22f6dc588f4bb055a958e69aff3a31e7e21bb1709
SSDEEP

24576:sKc5o+KpP+HmLqx/SW29peHUb1BqKDg1qstNuheP4gRBsyhpVW5rcwJcwL5:hgDM0Ub1BqKDg1qstNuheP4gRWyhpVPs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4136 wrote to memory of 548	4136	rundll32.exe	84
PID 4136 wrote to memory of 548	4136	rundll32.exe	84
PID 4136 wrote to memory of 548	4136	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\libeay32.dll,#1
  2⤵
  PID:548