5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324

Analysis

max time kernel
1761s
max time network
1491s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:51

Target

openvpn/ssleay32.dll
Size

232KB
MD5

afaead8eecbc3e59279e110fa24bb381
SHA1

ab075ec3b4eb23c75a801749a21b873a6b68a563
SHA256

86d47b314ce7a2c41e2b1416e2a6a7a25ea75b22473cfe3748611fc6b85fba61
SHA512

9ff014e16aa880b62c3de0962120c565bfbcace0b0ec811981cb4e64d352fa63c35efe27123544f893837a362f9b3264180747031d07517a002c47ff82904a34
SSDEEP

6144:ojyFZOZowisEQKfa1cF0P7gptqd+mm9BlIlVmAANpseSyazWkaWWS4EwjTOhzK8d:ojUOZoBsEQKfaiF0Ytqd+Z9BlInmAANu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4852 wrote to memory of 4832	4852	rundll32.exe	84
PID 4852 wrote to memory of 4832	4852	rundll32.exe	84
PID 4852 wrote to memory of 4832	4852	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\ssleay32.dll,#1
  2⤵
  PID:4832

memory/4832-0-0x0000000002B20000-0x0000000002C32000-memory.dmp

Filesize
1.1MB

Download