ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
28-04-2024 10:49

Target

ssleay32.dll
Size

344KB
MD5

355152cca9e9493de9fde0fde7c5d21f
SHA1

a1687ce7793a38e82db3eeeafacb439c44aa78a5
SHA256

a076c5707b4ae82d3a62f7300023a2a933dbf3cc3f83b4bb8edc6867105be013
SHA512

89db321f17fef11a7c3eac39de1bd58e550114cdb77e48e4016f059537e81acc0de7f378b923597d2f534f597e708b9db82de05b35d074d42eb86cbc08da2076
SSDEEP

6144:DsJ+TKsWjwovdOP44Ekqc4sLzmZDQDT13pf8TH3bKck/xD/tk4NREx4Q2sChEp6n:DsJ+OsWjwovdOP44EHc4sLzmZDuT13d1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 780 wrote to memory of 2716	780	rundll32.exe	rundll32.exe
PID 780 wrote to memory of 2716	780	rundll32.exe	rundll32.exe
PID 780 wrote to memory of 2716	780	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
2⤵
PID:2716

memory/2716-0-0x00000000025D0000-0x0000000002717000-memory.dmp

Filesize
1.3MB

Download