d1f93def665db5c4debf60314af20c13f054913bed2241dd370bb20b43245f5c

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 03:41

Target
DriverLib.dll
Size 387KB
Sample260928-d8ty5avyht
SHA256 d1f93def665db5c4debf60314af20c13f054913bed2241dd370bb20b43245f5c
MD5 f9b195c25ef24ad6c3d9cb84ad163233
SHA1 51ce94fbc6980d7f8e06fc42531b927854e069f1
SHA512 62d3ba908a034846b9e54b8bdc787482b9a80839f327a1efd5cd6d340ba99ecf7e5c0ee83b76e9b75fa5f6be2611d42796933f88a36800bfb438601f157ac09f
SSDEEP 6144:8N9/TrJmP9K+eeDnjmGhsBOa8CQYOO+2LKHxXR/iinpoO:8N9/PJL+fDyGCBGCRHGHxFtn
TLSH
T1BF846C4AF7A40475E0F79278CD735906DA727C5A0370D68F23A4465B2F37FA0AA3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4296	Loader.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\CLSID	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\CLSID\{FE055E37-B099-4E98-A4D3-FB4CEEF749A1}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\CLSID\{FE055E37-B099-4E98-A4D3-FB4CEEF749A1}\Shell\Manage	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\CLSID\{FE055E37-B099-4E98-A4D3-FB4CEEF749A1}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" "	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\CLSID\{FE055E37-B099-4E98-A4D3-FB4CEEF749A1}\Shell\Manage\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\CLSID\{FE055E37-B099-4E98-A4D3-FB4CEEF749A1}\Shell	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
812	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5068	OpenWith.exe
5916	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 2392	3848	rundll32.exe	91
PID 5916 wrote to memory of 4296	5916	explorer.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverLib.dll,#1
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\explorer.exe
  explorer.exe shell:::{FE055E37-B099-4E98-A4D3-FB4CEEF749A1}
  2⤵
  PID:2392

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5916
- C:\ProgramData\OpenraVPN\Loader.exe
  "C:\ProgramData\OpenraVPN\Loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4296

Loader.exe

Path C:\ProgramData\OpenraVPN\Loader.exe
Size 88KB
SHA256 4b84dc6750937eb47b19cde0d23debd4d2f2211300171b36d13ef5ad11dd60f9
MD5 025b13bf5652712d9b596e6766a9c386
SHA1 def4011b5536983285472ba75c22c6a2410edf6a
SHA512 f9983b897ef7ecbeb6cbfe599b24f5aa8651058d2e3313534a2a5e076f93fc3354784c05260b42fa828e48a55b5c005bfaa9db4e387351bf2e665ea0245c3a1e
SSDEEP 1536:7i3jG+UJuhM2HLJPl1M8CFYNMjYrZ3bXWgmqR9jR:KkuB5GFYNME3C9KR
TLSH
T11993185E72A830E5E9369139C4A24605E3B1B03563135BFF06E0C2BD5F23AE5AD39F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download