01670c33fe72400a225bbf6fcb2ef08e38e07288dde7d19e13d50dfe0c430b69

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 21:19

Target

01670c33fe72400a225bbf6fcb2ef08e38e07288dde7d19e13d50dfe0c430b69.dll
Size

160KB
MD5

0d2c0bcb10e44bd8e8e20d62ea6effd7
SHA1

467252da77a37130a07df01998926248a287eb14
SHA256

01670c33fe72400a225bbf6fcb2ef08e38e07288dde7d19e13d50dfe0c430b69
SHA512

37d779a6933306fb2f45a0d1e50a7d2844669cde42738cac31e3275081efa7452c7adf9bdb33fc633abf4ebf3d8cd73d467b841caf4871e1574aa59e7e49ef54
SSDEEP

3072:+2qUzQVS5RaAAsetOxJsoM94g6jIOmTgMFkI+EuBH9COA8iOP//JNL/poHWA76/:TH5AhoM2Fj8fvu2OAJOPp5/pr8m

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2044-56-0x0000000010000000-0x0000000010068000-memory.dmp	vmprotect
behavioral1/memory/2044-59-0x0000000010000000-0x0000000010068000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01670c33fe72400a225bbf6fcb2ef08e38e07288dde7d19e13d50dfe0c430b69.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01670c33fe72400a225bbf6fcb2ef08e38e07288dde7d19e13d50dfe0c430b69.dll,#1
  2⤵
  PID:2044

memory/2044-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/2044-56-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download
memory/2044-59-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download