409ef1134918ca40c0e9acd913bc1bcc69ab7512f61ab6b9498ac1b08fe47eb2

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 03:29

Target
DriverInst.dll
Size 125KB
Sample260930-d14hlay18m
SHA256 409ef1134918ca40c0e9acd913bc1bcc69ab7512f61ab6b9498ac1b08fe47eb2
MD5 d3d255350a13c6f58a5572a714fc5db0
SHA1 bf780eb8c0bc91af67f48ee74bdf0a9c6967d852
SHA512 e1642a028a8ac2bf6d867a62cdf40e74620da5c6edaa29c71c94a9d78792ee2375753a6e3a2e9af7d7e7f9d285687e29ce59558029b616a7fb3d3d605866865b
SSDEEP 3072:YuoQTKq2s8E8nVW+HwKqLc673XEUW4wTZjXbyM:h/uCy2ANRNjXb
TLSH
T12FC3074B77E405A9E2F7A378EDA30502DBB2BC460721D34F13D1919B0F66B90BD6A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4292	Loader.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{444DAA80-D181-4430-890E-3BDB0A3DFD62}\Shell\Manage	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{444DAA80-D181-4430-890E-3BDB0A3DFD62}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" "	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{444DAA80-D181-4430-890E-3BDB0A3DFD62}\Shell\Manage\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{444DAA80-D181-4430-890E-3BDB0A3DFD62}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{444DAA80-D181-4430-890E-3BDB0A3DFD62}\Shell	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3676	rundll32.exe
3676	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
452	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 2524	3676	rundll32.exe	99
PID 4840 wrote to memory of 4292	4840	explorer.exe	101

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverInst.dll,#1
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\explorer.exe
  explorer.exe shell:::{444DAA80-D181-4430-890E-3BDB0A3DFD62}
  2⤵
  PID:2524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4840
- C:\ProgramData\OpenraVPN\Loader.exe
  "C:\ProgramData\OpenraVPN\Loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4292

Loader.exe

Path C:\ProgramData\OpenraVPN\Loader.exe
Size 70KB
SHA256 b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
MD5 ef3179d498793bf4234f708d3be28633
SHA1 dd399ae46303343f9f0da189aee11c67bd868222
SHA512 02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
SSDEEP 1536:J8qpnO/qRUNReI3fu6Uw2mTARPw2cm+YRQln5IUmDjoX:C/YUNRBfukTreXRQln5I
TLSH
T16B630BC9A66460F4E077953444734E099272BC22D7625ADF54F0F17C0FF36E0A93AAAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dpnhupnp.dll

Path C:\ProgramData\OpenraVPN\dpnhupnp.dll
Size 10KB
SHA256 7cf4535e85ec02365c54bf460992344fe1e319381e794e51a7ce0f9cb0438929
MD5 ba32bb24b7da23bd7ee7ae4b576338cd
SHA1 17731367250361c6b1aaf24f988b8dd1150b1e92
SHA512 4317c083c491e74ef7e1ad30d79164b3d6ba360f3b83a88d220b21385837049a33c3023c5f9d10c42980c45fecc747d271263242976435abab7612c26e486be4
SSDEEP 96:FjxR3HUNj9fs2Qz6IDyBTFdesMH3aLbJ0lq5/sEWRuWwl:FtmzzyyBJdQH3aXSlSWRuW
TLSH
T1CE22A80AB7B809ADF06602F8876A5D5AE1757110536266EF0230C35D3F2EBD1BD34BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download