2661ec0a0e9292c580ae663ffad6b19e860278dfa681af9e49db137819b9bd16

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:07

Target

Data/OpenVPN/liblzo2-2.dll
Size

170KB
MD5

7147f51f060f4570b401303df7a4ffbc
SHA1

3888c27f39b45262bb093e9a83cbd55ebcd28528
SHA256

d5d22f9c69c20390564ca60a5e22d6891348af208ca5168441726587ef9535f0
SHA512

c3a76049982830824e3f72abe2dbb222542d781369333f08e52911623c5ad4e5b7a53107504db93dbde8b5cffe90aa8cb03a9dd474387fd13221ce994253264c
SSDEEP

3072:5h5CDZ37FRuI7hDEjQ777RZ7B7T7N55Fjh/YAWFOEBhzFJEB55jKN:w3bRn9ZNnB5NfKN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

320 500 WerFault.exe rundll32.exe

pid	pid_target	process	target process
320	500	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1312 wrote to memory of 500	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 500	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 500	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 500	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 500	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 500	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 500	1312	rundll32.exe	rundll32.exe
PID 500 wrote to memory of 320	500	rundll32.exe	WerFault.exe
PID 500 wrote to memory of 320	500	rundll32.exe	WerFault.exe
PID 500 wrote to memory of 320	500	rundll32.exe	WerFault.exe
PID 500 wrote to memory of 320	500	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\OpenVPN\liblzo2-2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\OpenVPN\liblzo2-2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 500 -s 220
    3⤵
    - Program crash
    PID:320

memory/500-0-0x00000000747D0000-0x00000000747FF000-memory.dmp

Filesize
188KB

Download