5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324

Analysis

max time kernel
1790s
max time network
1803s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2024, 20:34

Target

openvpn/libpkcs11-helper-1.dll
Size

62KB
MD5

412d8de4eefefdaa93c9ba64cd429f07
SHA1

f6e07cffc4cb0bbe1634a6759a33f64daf8eb2f7
SHA256

0f859769b51c270e90d78dd0340777afb967906a392f5184a9f5b1b0569fd8cb
SHA512

84d95cb7f5e025a6c3fd3301c65394dc95e5bcf003fc08274b40da5060c28b8b294a4765ab7982488fd307e0d79fdabbe2fbf57fe836546835ccaa293a5bc6a9
SSDEEP

1536:zfhvpG1JZCtAG9+STw05L+cUHcks92PT99C0zjXg2PmFjBU53Q5:dwhwA++SkvZHck/T99C0zJ0Bcg5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4880	3800	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 3800	1804	rundll32.exe	90
PID 1804 wrote to memory of 3800	1804	rundll32.exe	90
PID 1804 wrote to memory of 3800	1804	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\libpkcs11-helper-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\libpkcs11-helper-1.dll,#1
  2⤵
  PID:3800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 636
    3⤵
    - Program crash
    PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3800 -ip 3800
1⤵
PID:440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4128 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:1108

memory/3800-0-0x0000000002770000-0x0000000002882000-memory.dmp

Filesize
1.1MB

Download