5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324

Analysis

max time kernel
1545s
max time network
1519s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:51

Target

openvpn/msvcr90.dll
Size

640KB
MD5

e7d91d008fe76423962b91c43c88e4eb
SHA1

29268ef0cd220ad3c5e9812befd3f5759b27a266
SHA256

ed0170d3de86da33e02bfa1605eec8ff6010583481b1c530843867c1939d2185
SHA512

c3d5da1631860c92decf4393d57d8bff0c7a80758c9b9678d291b449be536465bda7a4c917e77b58a82d1d7bfc1f4b3bee9216d531086659c40c41febcdcae92
SSDEEP

12288:whr4UCeaHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axTFmRyyrRzS:ga2g5gmO791I0E5uO9FANpmRyyg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3532 wrote to memory of 1608	3532	rundll32.exe	82
PID 3532 wrote to memory of 1608	3532	rundll32.exe	82
PID 3532 wrote to memory of 1608	3532	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\msvcr90.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\msvcr90.dll,#1
  2⤵
  PID:1608