d1f93def665db5c4debf60314af20c13f054913bed2241dd370bb20b43245f5c

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 03:41

Target
DriverLib.dll
Size 387KB
Sample260928-d8ty5avyht
SHA256 d1f93def665db5c4debf60314af20c13f054913bed2241dd370bb20b43245f5c
MD5 f9b195c25ef24ad6c3d9cb84ad163233
SHA1 51ce94fbc6980d7f8e06fc42531b927854e069f1
SHA512 62d3ba908a034846b9e54b8bdc787482b9a80839f327a1efd5cd6d340ba99ecf7e5c0ee83b76e9b75fa5f6be2611d42796933f88a36800bfb438601f157ac09f
SSDEEP 6144:8N9/TrJmP9K+eeDnjmGhsBOa8CQYOO+2LKHxXR/iinpoO:8N9/PJL+fDyGCBGCRHGHxFtn
TLSH
T1BF846C4AF7A40475E0F79278CD735906DA727C5A0370D68F23A4465B2F37FA0AA3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4664	Loader.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{B43A564E-DCAB-4156-B125-49CB12C0F3A0}\Shell\Manage\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{B43A564E-DCAB-4156-B125-49CB12C0F3A0}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{B43A564E-DCAB-4156-B125-49CB12C0F3A0}\Shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{B43A564E-DCAB-4156-B125-49CB12C0F3A0}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" "	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{B43A564E-DCAB-4156-B125-49CB12C0F3A0}\Shell\Manage	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2656	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 4516	2468	rundll32.exe	99
PID 2660 wrote to memory of 4664	2660	explorer.exe	101

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverLib.dll,#1
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\explorer.exe
  explorer.exe shell:::{B43A564E-DCAB-4156-B125-49CB12C0F3A0}
  2⤵
  PID:4516

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2660
- C:\ProgramData\OpenraVPN\Loader.exe
  "C:\ProgramData\OpenraVPN\Loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4664

Loader.exe

Path C:\ProgramData\OpenraVPN\Loader.exe
Size 70KB
SHA256 b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
MD5 ef3179d498793bf4234f708d3be28633
SHA1 dd399ae46303343f9f0da189aee11c67bd868222
SHA512 02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
SSDEEP 1536:J8qpnO/qRUNReI3fu6Uw2mTARPw2cm+YRQln5IUmDjoX:C/YUNRBfukTreXRQln5I
TLSH
T16B630BC9A66460F4E077953444734E099272BC22D7625ADF54F0F17C0FF36E0A93AAAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dpnhupnp.dll

Path C:\ProgramData\OpenraVPN\dpnhupnp.dll
Size 10KB
SHA256 7cf4535e85ec02365c54bf460992344fe1e319381e794e51a7ce0f9cb0438929
MD5 ba32bb24b7da23bd7ee7ae4b576338cd
SHA1 17731367250361c6b1aaf24f988b8dd1150b1e92
SHA512 4317c083c491e74ef7e1ad30d79164b3d6ba360f3b83a88d220b21385837049a33c3023c5f9d10c42980c45fecc747d271263242976435abab7612c26e486be4
SSDEEP 96:FjxR3HUNj9fs2Qz6IDyBTFdesMH3aLbJ0lq5/sEWRuWwl:FtmzzyyBJdQH3aXSlSWRuW
TLSH
T1CE22A80AB7B809ADF06602F8876A5D5AE1757110536266EF0230C35D3F2EBD1BD34BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download