9132c7aab51c97f8204e786e00215e5c7fe8ecbe9be5151aa0e19dfaaa4c1987

Analysis

max time kernel
36s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 14:53

Target

9132c7aab51c97f8204e786e00215e5c7fe8ecbe9be5151aa0e19dfaaa4c1987.dll
Size

848KB
MD5

153d274e8b91323fb0ea9d82d7113d80
SHA1

6b77f768ecdd41b731d7e0e2a334102168376c20
SHA256

9132c7aab51c97f8204e786e00215e5c7fe8ecbe9be5151aa0e19dfaaa4c1987
SHA512

b64a302c51b1c1addd8d70480a809cb3ad7b4734be0449dc0f4c748358908bb3942dc4f4898b45a8841b102e0d453f6012987a34217da78961a38b1291a499b8
SSDEEP

24576:b+yw44EUzlQKI6Y9/hMY78DksUXOhHdPTv1B:b+yxY/I6+v784sUXsJhB

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1756-56-0x0000000000950000-0x0000000000AF4000-memory.dmp	vmprotect
behavioral1/memory/1756-57-0x0000000000950000-0x0000000000AF4000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1756	1016	rundll32.exe	25
PID 1016 wrote to memory of 1756	1016	rundll32.exe	25
PID 1016 wrote to memory of 1756	1016	rundll32.exe	25
PID 1016 wrote to memory of 1756	1016	rundll32.exe	25
PID 1016 wrote to memory of 1756	1016	rundll32.exe	25
PID 1016 wrote to memory of 1756	1016	rundll32.exe	25
PID 1016 wrote to memory of 1756	1016	rundll32.exe	25

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9132c7aab51c97f8204e786e00215e5c7fe8ecbe9be5151aa0e19dfaaa4c1987.dll,#1
1⤵
PID:1756

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9132c7aab51c97f8204e786e00215e5c7fe8ecbe9be5151aa0e19dfaaa4c1987.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1016

memory/1756-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1756-56-0x0000000000950000-0x0000000000AF4000-memory.dmp

Filesize
1.6MB

Download
memory/1756-57-0x0000000000950000-0x0000000000AF4000-memory.dmp

Filesize
1.6MB

Download