0e91e7fb0c43654e7cfb23bf7269e4a25b6b18c457967cf8b578d3257aed9643

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:25

Target
HomeWayVPN\HomeWayVPN.exe
Size 111KB
Sample260808-plvspade29
SHA256 0e91e7fb0c43654e7cfb23bf7269e4a25b6b18c457967cf8b578d3257aed9643
MD5 b282af627401bff74e04c7e3a4482c13
SHA1 df52fa7d0a9c67b4d65e9a9a879854c9d5b4d80e
SHA512 f9a50a98efb357e905bb087a1a60c8f8bccd844b4b2e3d199da3ad2e6465c9102b95973735205c7a836b214c97dd088600fb3d80aeec70de9a3cb571206a0e0e
SSDEEP 1536:i4oGGpXb8PFxPjcf6iMfxoFhZGsb8+tJT3me/NrjG6QW+tuFrie1n1T:i4oRb8PFxm6/ZBsb8yZme/NXUWOu91T
TLSH
T1C8B37D2BEB5950EAE21AC939CA438906CB71BC9647919BCF5B500E970F27ED44F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
940	HomeWayVPN.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
940	HomeWayVPN.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
940	HomeWayVPN.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 3392	940	HomeWayVPN.exe	89
PID 940 wrote to memory of 4800	940	HomeWayVPN.exe	90

C:\Users\Admin\AppData\Local\Temp\HomeWayVPN\HomeWayVPN.exe
"C:\Users\Admin\AppData\Local\Temp\HomeWayVPN\HomeWayVPN.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940
- C:\Users\Admin\AppData\Local\Temp\HomeWayVPN\watchdog.exe
  C:\Users\Admin\AppData\Local\Temp\HomeWayVPN\watchdog.exe --reg get ProxyServer
  2⤵
  PID:3392
- C:\Users\Admin\AppData\Local\Temp\HomeWayVPN\watchdog.exe
  C:\Users\Admin\AppData\Local\Temp\HomeWayVPN\watchdog.exe --run "schtasks /Create /TN HomewayVPN-StaleProxyFix /SC ONLOGON /TR \"\\\"C:\Users\Admin\AppData\Local\Temp\HomeWayVPN\watchdog.exe\\\" --fix\" /F"
  2⤵
  PID:4800

memory/940-0-0x000001AB97290000-0x000001AB97291000-memory.dmp

Download

memory/940-2-0x000001AB99850000-0x000001AB99D91000-memory.dmp

Download

memory/940-1-0x000001AB99850000-0x000001AB99D91000-memory.dmp

Download

memory/940-3-0x000001AB99850000-0x000001AB99D91000-memory.dmp

Download

memory/940-4-0x000001AB996F0000-0x000001AB996F1000-memory.dmp

Download