5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
80s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
13/01/2024, 04:57

Target
ovpn/libpkcs11-helper-1.dll
Size 123KB
Sample240113-fla9lscdgl
SHA256 6f0e5fbeec6474e0cc2bd0536aed3ff47fef4588fe28625ce2b3eaacb5f0dead
MD5 5e12d4d264ba957604e80ebbb436c61b
SHA1 50ad9a622518989a80355d226b77c5c57aecba64
SHA512 e4dbb5e094b48bb47a30dc5782b9a5b58dd039c626922cc7884c00f2bc24ae4c457b11e2889ff373cc592c47daf1511ca4ab10a6f26f7f2f745efd9e64a5f002
SSDEEP 3072:tACv01QslFoJiU4ixhvt5hTQQU7kVTAHluobjrf1Evu5g8V:tPv01rI3t5hTQQU7kVTAHluobjrf1Evu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2284	2440	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 2440	3608	rundll32.exe	79
PID 3608 wrote to memory of 2440	3608	rundll32.exe	79
PID 3608 wrote to memory of 2440	3608	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libpkcs11-helper-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libpkcs11-helper-1.dll,#1
  2⤵
  PID:2440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 492
    3⤵
    - Program crash
    PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2440 -ip 2440
1⤵
PID:2596

memory/2440-0-0x0000000074DD0000-0x000000007508E000-memory.dmp

Download

memory/2440-1-0x0000000075090000-0x00000000750B3000-memory.dmp

Download

memory/2440-2-0x0000000074DD0000-0x000000007508E000-memory.dmp

Download