3a4fdb3a9b8a659cc336159f9473b70d747c22a357920e8052b9621f2a789310

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 14:40

Target

InterVpn/bin/libpkcs11-helper-1.dll
Size

109KB
MD5

63b23a24778f3ef27bd53afa3115f901
SHA1

49fcb47e8ab2dd180dbb946df580794890f5292b
SHA256

cc9ec9f9a54706d02f63cc4f46ca567812c1f0669451e94096f5358b00893be6
SHA512

bd7339e3911ab75ddf805555e0f59e65927f1539a5561b22456e25f3d1868fb42d89cd95eaa96c3335fef7d3ec2a21ff7c53f04961fedc5e374f43f4070df58c
SSDEEP

3072:iTkZbJ/CqOFvICeSPUbT3Xf0j4smxh9QQU7kVTAHluobjrHEN8gE:PaVVeXT3XfVxh9QQU7kVTAHluobjrHEQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2476 wrote to memory of 2060	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2060	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2060	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2060	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2060	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2060	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2060	2476	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\InterVpn\bin\libpkcs11-helper-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\InterVpn\bin\libpkcs11-helper-1.dll,#1
2⤵
PID:2060