99932e6dbe1103e83b0468d11bda2808d22d5522f91b78ca6a3c06a5a85b3210

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 12:27

Target

OpenVPN64/bin/libpkcs11-helper-1.dll
Size

120KB
MD5

4f53937cc7a8b29dc2727926cc51c35e
SHA1

bf4173ebe91643c728fd1f23c8c6828e93f8af98
SHA256

cc2600e135a13ab57f9058246a41900320f0cfc0f91bc7f27706e8cbce4ebddb
SHA512

e79823028d2ef2071ede0206676886886c18ea9b34bf71b02b384c0258f0164cb2a4769055d5676a1266bcea6687aff84cb17996af8a1cc36a3166584f44d7f3
SSDEEP

3072:drTfD84ULMskuJiUBpABbr+RixR0QQU7k1TAH1OobTr8qQ1EsQGF3s:RLDnUL6uJrBpAd+8xR0QQU7k1TAH1OoP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2776	2240	rundll32.exe	31
PID 2240 wrote to memory of 2776	2240	rundll32.exe	31
PID 2240 wrote to memory of 2776	2240	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OpenVPN64\bin\libpkcs11-helper-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2240 -s 184
  2⤵
  PID:2776

memory/2240-0-0x00000000645C0000-0x00000000645E2000-memory.dmp

Filesize
136KB

Download
memory/2240-1-0x0000000063000000-0x00000000631B5000-memory.dmp

Filesize
1.7MB

Download
memory/2240-2-0x00000000645C0000-0x00000000645E2000-memory.dmp

Filesize
136KB

Download
memory/2240-3-0x0000000063000000-0x00000000631B5000-memory.dmp

Filesize
1.7MB

Download