5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324

Analysis

max time kernel
92s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:42

Target

openvpn/libpkcs11-helper-1.dll
Size

62KB
MD5

412d8de4eefefdaa93c9ba64cd429f07
SHA1

f6e07cffc4cb0bbe1634a6759a33f64daf8eb2f7
SHA256

0f859769b51c270e90d78dd0340777afb967906a392f5184a9f5b1b0569fd8cb
SHA512

84d95cb7f5e025a6c3fd3301c65394dc95e5bcf003fc08274b40da5060c28b8b294a4765ab7982488fd307e0d79fdabbe2fbf57fe836546835ccaa293a5bc6a9
SSDEEP

1536:zfhvpG1JZCtAG9+STw05L+cUHcks92PT99C0zjXg2PmFjBU53Q5:dwhwA++SkvZHck/T99C0zJ0Bcg5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4772	184	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 5028 wrote to memory of 184	5028	rundll32.exe	84
PID 5028 wrote to memory of 184	5028	rundll32.exe	84
PID 5028 wrote to memory of 184	5028	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\libpkcs11-helper-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvpn\libpkcs11-helper-1.dll,#1
  2⤵
  PID:184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 636
    3⤵
    - Program crash
    PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 184 -ip 184
1⤵
PID:4792

memory/184-0-0x0000000002680000-0x0000000002792000-memory.dmp

Filesize
1.1MB

Download