421a92d155959ae6652724131ad2ba71be24803c33a8b863e09da59d7fae7c5d

Analysis

max time kernel
32s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 19:49

Target

BlackLegend Public/BlackLegend Public.dll
Size

222KB
MD5

8532746ea5bca749229d3e1974e94c89
SHA1

073f15d554fa9ea088dc940d237eafa147388b06
SHA256

d08ddd289fe0763ea15945091d9120b48ff1afedcfb7301711e8f341687d4c43
SHA512

cd9a3bd5553f0f680cf7a370f4128872b5ef2202d97748afc1ab18fc483c8b9c8d984cf947e19d91840d646e4a58899a3cae14692980a5d689356092d4730b5b
SSDEEP

6144:lmtu9R7AaM2CYQoZ/ZImh/6jmmtHnkm3D:Wy3M2uVLmmtHN

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/240-56-0x00000000744F0000-0x0000000074582000-memory.dmp	vmprotect
behavioral1/memory/240-60-0x00000000744F0000-0x0000000074582000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
240	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1360	240	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 240	964	rundll32.exe	28
PID 964 wrote to memory of 240	964	rundll32.exe	28
PID 964 wrote to memory of 240	964	rundll32.exe	28
PID 964 wrote to memory of 240	964	rundll32.exe	28
PID 964 wrote to memory of 240	964	rundll32.exe	28
PID 964 wrote to memory of 240	964	rundll32.exe	28
PID 964 wrote to memory of 240	964	rundll32.exe	28
PID 240 wrote to memory of 1360	240	rundll32.exe	29
PID 240 wrote to memory of 1360	240	rundll32.exe	29
PID 240 wrote to memory of 1360	240	rundll32.exe	29
PID 240 wrote to memory of 1360	240	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BlackLegend Public\BlackLegend Public.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BlackLegend Public\BlackLegend Public.dll",#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 216
    3⤵
    - Program crash
    PID:1360

memory/240-55-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/240-56-0x00000000744F0000-0x0000000074582000-memory.dmp

Filesize
584KB

Download
memory/240-60-0x00000000744F0000-0x0000000074582000-memory.dmp

Filesize
584KB

Download
memory/240-61-0x0000000074590000-0x0000000074622000-memory.dmp

Filesize
584KB

Download
memory/240-62-0x00000000744F0000-0x0000000074582000-memory.dmp

Filesize
584KB

Download
memory/240-64-0x0000000074590000-0x0000000074622000-memory.dmp

Filesize
584KB

Download