2a64743382f57d6e2ec30660f46c2a65a12c1b9c897260a07c8b30e971cee291

Resubmissions

25-04-2024 16:33

25-04-2024 16:27

max time kernel
114s
max time network
140s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25-04-2024 16:27

Target

files/libs/ssleay32.dll
Size

270KB
MD5

df38eb2002e5979e57babf8b4f6a2f82
SHA1

219d5837f6461688122d637bf67f041fc6c19aac
SHA256

5c2f10a772edfbeef8a5261b8677e68c4194cb87f3cb9bc319c8da75cfaefa3f
SHA512

da4b6ec820f5886102577a7e98187ed45165ee5373504fb4f610cfb47eb2ad6e0b75d868464df4ee8b97f506c2f493a1d3bf029c184c08b311dbc1b76c2a37f6
SSDEEP

6144:0xnT+R40IInTyFxvYlBtCikIK3gb/VuLXyJxm11VMaorgpa7ivoQXoYwWAaHeeT6:6nKR40IInTyFxvY3tCikIK3gb/VECJxD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4444 wrote to memory of 3932	4444	rundll32.exe	rundll32.exe
PID 4444 wrote to memory of 3932	4444	rundll32.exe	rundll32.exe
PID 4444 wrote to memory of 3932	4444	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\libs\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\libs\ssleay32.dll,#1
  2⤵
  PID:3932