0ff0d7f6a67bb2daa879f111d4649231cb3bd89090085a06c9039aabc5fecb2a

Analysis

max time kernel
133s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 09:05

Target

dll/ssleay32.dll
Size

270KB
MD5

df38eb2002e5979e57babf8b4f6a2f82
SHA1

219d5837f6461688122d637bf67f041fc6c19aac
SHA256

5c2f10a772edfbeef8a5261b8677e68c4194cb87f3cb9bc319c8da75cfaefa3f
SHA512

da4b6ec820f5886102577a7e98187ed45165ee5373504fb4f610cfb47eb2ad6e0b75d868464df4ee8b97f506c2f493a1d3bf029c184c08b311dbc1b76c2a37f6
SSDEEP

6144:0xnT+R40IInTyFxvYlBtCikIK3gb/VuLXyJxm11VMaorgpa7ivoQXoYwWAaHeeT6:6nKR40IInTyFxvY3tCikIK3gb/VECJxD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 924 wrote to memory of 2392	924	rundll32.exe	rundll32.exe
PID 924 wrote to memory of 2392	924	rundll32.exe	rundll32.exe
PID 924 wrote to memory of 2392	924	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\ssleay32.dll,#1
2⤵
PID:2392