012329ab7790019eb3453f5b33193205d2299802bf34862d9ffef56b2b1d12a0

Analysis

max time kernel
135s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:52

Target

cgminer-3.7.2-blake/ssleay32.dll
Size

356KB
MD5

612b2747d39d9ef838ab9eacbc1f6c3a
SHA1

3df032de697521589264bb9a89ad0f4a3cc7b099
SHA256

c3dde5b99c3b5b7fe2a0fc2d198c0ccdccda8e5551d5dcee186f1c67e9f40f1d
SHA512

1048b7c48c351e57c3f4cfdbdeb3dfdad235f740ac2b01bb6e739f189c3a2eca4bacb2e4b08b7c9850ebfb09fba142ef4c00798ba7b1b8a620b0994e07b3ce1d
SSDEEP

6144:aL+rxfMxrJCtRyU05sDk75xdYf6Bkm9jjAbMCMhKObI/Z+YeMJ9gmvEb2xqamLn7:MgKBJWRyU0tAM0ObkZ+YewEbqqGS8+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2332 wrote to memory of 4436	2332	rundll32.exe	rundll32.exe
PID 2332 wrote to memory of 4436	2332	rundll32.exe	rundll32.exe
PID 2332 wrote to memory of 4436	2332	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cgminer-3.7.2-blake\ssleay32.dll,#1
2⤵
PID:4436