99c2474f5bea6e3955d1002aa98678c32e9c0e9f2fb6d0c35d3a428ec279d103

Analysis

max time kernel
145s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 04:44

Target

ovpn/libpkcs11-helper-1.dll
Size

123KB
MD5

5e12d4d264ba957604e80ebbb436c61b
SHA1

50ad9a622518989a80355d226b77c5c57aecba64
SHA256

6f0e5fbeec6474e0cc2bd0536aed3ff47fef4588fe28625ce2b3eaacb5f0dead
SHA512

e4dbb5e094b48bb47a30dc5782b9a5b58dd039c626922cc7884c00f2bc24ae4c457b11e2889ff373cc592c47daf1511ca4ab10a6f26f7f2f745efd9e64a5f002
SSDEEP

3072:tACv01QslFoJiU4ixhvt5hTQQU7kVTAHluobjrf1Evu5g8V:tPv01rI3t5hTQQU7kVTAHluobjrf1Evu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4576	1196	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1196	4796	rundll32.exe	79
PID 4796 wrote to memory of 1196	4796	rundll32.exe	79
PID 4796 wrote to memory of 1196	4796	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libpkcs11-helper-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libpkcs11-helper-1.dll,#1
  2⤵
  PID:1196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 500
    3⤵
    - Program crash
    PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1196 -ip 1196
1⤵
PID:4852

memory/1196-0-0x0000000074DF0000-0x00000000750AE000-memory.dmp

Filesize
2.7MB

Download
memory/1196-1-0x00000000750B0000-0x00000000750D3000-memory.dmp

Filesize
140KB

Download
memory/1196-2-0x0000000074DF0000-0x00000000750AE000-memory.dmp

Filesize
2.7MB

Download