01331b4e2b83cff51879d394feefba66eb9b32cd3040c961379edf04f517235a

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 01:04

Target

ssleay32.dll
Size

330KB
MD5

5dbf9338e47e43bcee17f2da9f4bffc5
SHA1

eda920cf525e18bed7280352a02b0f3a7eec552f
SHA256

a78a1c2cba9ca1f057851aa43ecc34080fd607aa46026a5655cde8270dda3a05
SHA512

02eb426f6c8a5469b42c82ab0c25b59794eca21444f2114b603b399a9aca03bc558dbc4f6e6dd669dd1b341c3304d99fb207430cdc6770459850622f6fd9f1df
SSDEEP

6144:vgnOGg4dYb2HX5x9iJ64iqu7Zh6CMXl8h+i6z1tWjrP74h/vbA28eq7QvvygTUER:vw84dYyHX5x9a64iqUL6CMXl8Mi6z1tj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2472	2288	rundll32.exe	28
PID 2288 wrote to memory of 2472	2288	rundll32.exe	28
PID 2288 wrote to memory of 2472	2288	rundll32.exe	28
PID 2288 wrote to memory of 2472	2288	rundll32.exe	28
PID 2288 wrote to memory of 2472	2288	rundll32.exe	28
PID 2288 wrote to memory of 2472	2288	rundll32.exe	28
PID 2288 wrote to memory of 2472	2288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
  2⤵
  PID:2472