2661ec0a0e9292c580ae663ffad6b19e860278dfa681af9e49db137819b9bd16

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:07

Target

Data/OpenVPN/libeay32.dll
Size

2.2MB
MD5

38c32ec7bfac41c8789bbc86b22d547a
SHA1

c64a38fd621256a5ec7b9cfae9deaa74934bac66
SHA256

7a14631f093cc459f48caab18635a034fdbcf27ac1dcaa64cd60e3440dedfd3d
SHA512

2bb7af81648b3172363a49500e92d21b8922fb0ef38c7a4c8975a93469232c41a445aac86147fd46bbcade3ab6f33d98b79a5de7061b82ed9a2eb037f27f35a6
SSDEEP

49152:qqrGLY4rzqgpJdli4OLz1/SK1ULLnLWdaqTv6akDCbpCX464lnbW148y1PuDT5WW:qqr0Y4rugpJdli4OLz1/SK1ULLLWdaqC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1232 wrote to memory of 1280	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1280	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1280	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1280	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1280	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1280	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1280	1232	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\OpenVPN\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\OpenVPN\libeay32.dll,#1
  2⤵
  PID:1280