b7683441e42f706642877d1a92c5307d223b1e6195d463f1ad9332e7e6ac5a91

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 17:03

Target

ssleay32.dll
Size

370KB
MD5

50a26f0247c1321fd19c0981337fbde8
SHA1

9cdd51843bd7694da571e0a6cd7350aa494f9ac3
SHA256

24235653e41540567bca708e0d5ef02034f88940eeedcd480167a00dd1250656
SHA512

440cf92524e21e9dc1d92f45a8fbd566f0eeec597e0f52a235847879bdd4806ac219b592aaec9976620082b2d8d5690d432e1a45b0df035b18404453530855d9
SSDEEP

6144:AlvshwnbLc7xRpLIOmvsD4gZAEMM06I5sF51L103WiV8JV+OPG/JVNr5qNRyZtrA:Al0LuEMM06IGF5UmiqJpPOp/cVmXEfcc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1880	1728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
2⤵
PID:1880