99c2474f5bea6e3955d1002aa98678c32e9c0e9f2fb6d0c35d3a428ec279d103

Analysis

max time kernel
121s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 04:44

Target

ovpn/libcrypto-1_1.dll
Size

3.2MB
MD5

b9eb6a8ac15e8eee936d994bc87f9d5e
SHA1

b432473b753f371bb2415eb63d178e560455d4c8
SHA256

548c59044738554e6fd8aee9e1cd0e6cb13ee7b6f4f71532aff868e771eb8a7d
SHA512

83688bdee057964072215de15039e27f0e3188fc32856183f9de3484f11d6cbd633f36c0f0abe7ec6f3eb17dd467c59e8cc8517a371091279270c6c2bb5c631c
SSDEEP

98304:+mjNt5deg7yCsF4Qd/CsIhu2w0ne8nB5U5jOmp9P1CPwDv3uFfJl2xEcFiuW9MZe:+mjVpGCsFldKsIhuSne8nBIjx9P1CPwE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4968	672	WerFault.exe	33

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 672	2416	rundll32.exe	33
PID 2416 wrote to memory of 672	2416	rundll32.exe	33
PID 2416 wrote to memory of 672	2416	rundll32.exe	33

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libcrypto-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libcrypto-1_1.dll,#1
  2⤵
  PID:672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 488
    3⤵
    - Program crash
    PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 672 -ip 672
1⤵
PID:3080

memory/672-0-0x00000000752C0000-0x000000007557E000-memory.dmp

Filesize
2.7MB

Download