e383f59c0f9c2cc20afcf20d6ef4c1690d30d724957aa3310b88acfcb5fd7dc2

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 08:58

Target

ssleay32.dll
Size

349KB
MD5

cf2c57dda3766c204c398430da23693d
SHA1

9938cbf4b5e7cffa0d73825a6ef85b0d90a0ce0a
SHA256

492f045643354c8b9fa11673b6c32cdbb33779826a729ce55de5901279c1f6d5
SHA512

e83e33b5bc9161351daaaae8e9130d83568d85b4a4ab190730e9558ddad199091f5b3acb3e1060dad5ec840a74f8b6781a086f49b7a1ecb6f82fc1cc265c536a
SSDEEP

6144:VaMcchXvecgMuZESAp8EQS59KrZ6K8KzNvNq4O7D9kU+yQ/ACLO6B5dMeYjByVFI:Va8XvecgMuZESAp85S59KrL8KzNFqx7x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4240 wrote to memory of 3080	4240	rundll32.exe	rundll32.exe
PID 4240 wrote to memory of 3080	4240	rundll32.exe	rundll32.exe
PID 4240 wrote to memory of 3080	4240	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
2⤵
PID:3080