5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
80s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 04:57

Target

ovpn/libpkcs11-helper-1.dll
Size

123KB
MD5

5e12d4d264ba957604e80ebbb436c61b
SHA1

50ad9a622518989a80355d226b77c5c57aecba64
SHA256

6f0e5fbeec6474e0cc2bd0536aed3ff47fef4588fe28625ce2b3eaacb5f0dead
SHA512

e4dbb5e094b48bb47a30dc5782b9a5b58dd039c626922cc7884c00f2bc24ae4c457b11e2889ff373cc592c47daf1511ca4ab10a6f26f7f2f745efd9e64a5f002
SSDEEP

3072:tACv01QslFoJiU4ixhvt5hTQQU7kVTAHluobjrf1Evu5g8V:tPv01rI3t5hTQQU7kVTAHluobjrf1Evu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2284	2440	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 2440	3608	rundll32.exe	79
PID 3608 wrote to memory of 2440	3608	rundll32.exe	79
PID 3608 wrote to memory of 2440	3608	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libpkcs11-helper-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovpn\libpkcs11-helper-1.dll,#1
  2⤵
  PID:2440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 492
    3⤵
    - Program crash
    PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2440 -ip 2440
1⤵
PID:2596

memory/2440-0-0x0000000074DD0000-0x000000007508E000-memory.dmp

Filesize
2.7MB

Download
memory/2440-1-0x0000000075090000-0x00000000750B3000-memory.dmp

Filesize
140KB

Download
memory/2440-2-0x0000000074DD0000-0x000000007508E000-memory.dmp

Filesize
2.7MB

Download