5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
141s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 04:57

Target

ovpn/libcrypto-1_1.dll
Size

3.2MB
MD5

b9eb6a8ac15e8eee936d994bc87f9d5e
SHA1

b432473b753f371bb2415eb63d178e560455d4c8
SHA256

548c59044738554e6fd8aee9e1cd0e6cb13ee7b6f4f71532aff868e771eb8a7d
SHA512

83688bdee057964072215de15039e27f0e3188fc32856183f9de3484f11d6cbd633f36c0f0abe7ec6f3eb17dd467c59e8cc8517a371091279270c6c2bb5c631c
SSDEEP

98304:+mjNt5deg7yCsF4Qd/CsIhu2w0ne8nB5U5jOmp9P1CPwDv3uFfJl2xEcFiuW9MZe:+mjVpGCsFldKsIhuSne8nBIjx9P1CPwE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2536	2244	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 2244	328	rundll32.exe	81
PID 328 wrote to memory of 2244	328	rundll32.exe	81
PID 328 wrote to memory of 2244	328	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libcrypto-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libcrypto-1_1.dll,#1
  2⤵
  PID:2244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 488
    3⤵
    - Program crash
    PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2244 -ip 2244
1⤵
PID:4308

memory/2244-0-0x0000000074AC0000-0x0000000074D7E000-memory.dmp

Filesize
2.7MB

Download