deab75d2e89891239e839490152f1149158b33cff13ee446928e7d3d67fc8ecb

Analysis

max time kernel
22s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17/04/2023, 17:54

Target

NewVersionUnlimited/Desktop_Full/resources/talpid_openvpn_plugin.dll
Size

3.5MB
MD5

b4afe105cc0e654d1edc41489ab709c4
SHA1

069781d90383978973e7afa6b9f1b730d781235e
SHA256

e0d947b7041d90eae87e6898822787bdc8452b8a403c42de901e46a0a04c46cd
SHA512

fff37ae7bdd3a86fa7a955b9acca812e1616dbdaac2c88f910706fd298457a981d526b7af25e7d810799e1718240f1a28bc4be2bcbc8d68dc3211707db92d573
SSDEEP

49152:0X6/nC0NttPHG8BWULqD0eBcLN6F1Vm15m56pi1APaVBZpDO+kGDYpb:FdXm8BWULqYTOBJkGs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
688	608	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 688	608	rundll32.exe	28
PID 608 wrote to memory of 688	608	rundll32.exe	28
PID 608 wrote to memory of 688	608	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewVersionUnlimited\Desktop_Full\resources\talpid_openvpn_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 608 -s 100
  2⤵
  - Program crash
  PID:688