7c77bdca7357705affd0a6fe9e00786f45cec9dcc8f11891f99348c1470c4d31

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 18:17

Target

7c77bdca7357705affd0a6fe9e00786f45cec9dcc8f11891f99348c1470c4d31.dll
Size

250KB
MD5

a3663bf4bc30763a2bb90408e648cf50
SHA1

1225701504a57229b77ab2df14a6d94bc217a654
SHA256

7c77bdca7357705affd0a6fe9e00786f45cec9dcc8f11891f99348c1470c4d31
SHA512

e0c1c9fa04e763070e4c99f3d88b0d27f9bc8f050e62011243d4fa55d5f1c2cbe8d83cad43df6c9974ced53fe7acd0cacf1af555d05906921b8777ffff80744a
SSDEEP

6144:CLo4mxqRbOssVMlhrWVr4M8NSMxf95QjR3SGlhvfWS:CL8Eys2Mjror4/IIs9JXN

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1472-56-0x0000000074670000-0x0000000074727000-memory.dmp	vmprotect
behavioral1/memory/1472-59-0x0000000074670000-0x0000000074727000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	1472	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1472	1948	rundll32.exe	28
PID 1948 wrote to memory of 1472	1948	rundll32.exe	28
PID 1948 wrote to memory of 1472	1948	rundll32.exe	28
PID 1948 wrote to memory of 1472	1948	rundll32.exe	28
PID 1948 wrote to memory of 1472	1948	rundll32.exe	28
PID 1948 wrote to memory of 1472	1948	rundll32.exe	28
PID 1948 wrote to memory of 1472	1948	rundll32.exe	28
PID 1472 wrote to memory of 1684	1472	rundll32.exe	29
PID 1472 wrote to memory of 1684	1472	rundll32.exe	29
PID 1472 wrote to memory of 1684	1472	rundll32.exe	29
PID 1472 wrote to memory of 1684	1472	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c77bdca7357705affd0a6fe9e00786f45cec9dcc8f11891f99348c1470c4d31.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c77bdca7357705affd0a6fe9e00786f45cec9dcc8f11891f99348c1470c4d31.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 220
    3⤵
    - Program crash
    PID:1684

memory/1472-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1472-56-0x0000000074670000-0x0000000074727000-memory.dmp

Filesize
732KB

Download
memory/1472-59-0x0000000074670000-0x0000000074727000-memory.dmp

Filesize
732KB

Download
memory/1472-60-0x0000000074730000-0x00000000747E7000-memory.dmp

Filesize
732KB

Download