5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324 | Triage

Analysis

max time kernel
1698s
max time network
1172s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:51

Sharing

Report Analysis Logs

General

Target

openvpn/libssl32.dll
Size

240KB
MD5

af692acf180ece8a671e5a9b2966d53a
SHA1

a4480255926f2cc04bf5b2cf05d89bbdd21e7acd
SHA256

e37400f913f5b5c418dd9886a36e51b5cba92f8a886ff6ac70e821f94a7df28a
SHA512

3a4acf333f53bed03fbd9b9c5ab17ad59f33ee759dc4c05b45121c80a94e72dac8b32cd97f7161d64ae44a62b6d7a748b6331e8f186f2a901b889c71415b46fc
SSDEEP

6144:qeaa7vd/Am8Akq61R2fUNQERcWX+RG3Zt67z08s2rSk:q0/JkV1QfHE2YzgPj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2408 wrote to memory of 4440	2408	rundll32.exe	84
PID 2408 wrote to memory of 4440	2408	rundll32.exe	84
PID 2408 wrote to memory of 4440	2408	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\libssl32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\libssl32.dll,#1
  2⤵
  PID:4440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads