5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324

Analysis

max time kernel
1387s
max time network
1177s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:51

Target

openvpn/lzo2.dll
Size

88KB
MD5

ca9eb74eb97d9cb38851822a7b7b26ba
SHA1

9c928b28329b86f8d1b0e38f53a4f71dac46c2a4
SHA256

915bf213b676f0af1d2400dd9b1667c6ee271cf989e6cf6237e31b85d326b39e
SHA512

f63ab3aa5845425b4ed157c4aa8f3a7d366d6a61f2299db69fe56b9f9017903db891c414d2f963bf61cf97c9362ad3595c1f207d63a7d4eb2abc70f59169c5a4
SSDEEP

768:NM3RrJeXc4fkCewUUi+iT3h5rJBUjN7QMeXd/WGB3ivxSuJf2gBIfNdFfD/ertN2:NM36kCewU5Tjh/CFQfN/W9vE2vuxerZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4104 wrote to memory of 4760	4104	rundll32.exe	85
PID 4104 wrote to memory of 4760	4104	rundll32.exe	85
PID 4104 wrote to memory of 4760	4104	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\lzo2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\lzo2.dll,#1
  2⤵
  PID:4760