5e0a049af1f3adf8e5c6126348e338c609a532ce40515dcf57141ac33238844c | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 11:47

Sharing

Report Analysis Logs

General

Target

libovpn.dll
Size

1.6MB
MD5

83b047ad1c8a33e34b0b569471d341ac
SHA1

7a91cfa9149a430f8384b97805a99daa93dffced
SHA256

5e0a049af1f3adf8e5c6126348e338c609a532ce40515dcf57141ac33238844c
SHA512

0ea727493b83016a30592e2daf3656397d395e25a7f07ed8ef017a08dd77dfb9e8744944eb83e0cab6d50bab5f2088c6649c49be6961baca6919c17d25056e64
SSDEEP

24576:d+jfSkk2pC2YbvRiR2MvqCrhs4UKHLz8T484zbUmhIppxFL7EbCa:d+D+12uKT5UKsU84zbUmhWba

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2212	1904	rundll32.exe	28
PID 1904 wrote to memory of 2212	1904	rundll32.exe	28
PID 1904 wrote to memory of 2212	1904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libovpn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1904 -s 208
  2⤵
  PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads