646ad5c5f3f23f7c6c078fa5b0c975f91be82e34747fbccfcce9fc23c21702ea

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 23:10

Target

646ad5c5f3f23f7c6c078fa5b0c975f91be82e34747fbccfcce9fc23c21702ea.dll
Size

252KB
MD5

0c5c7e327b8c64a3be36ab9c52978ad0
SHA1

aff2480a5fba9040f0667ed19d6649b5f105e8e5
SHA256

646ad5c5f3f23f7c6c078fa5b0c975f91be82e34747fbccfcce9fc23c21702ea
SHA512

7767428a29a30be7f98939dc777645bcbfde4cfd887a7293b671b10918a2b1317a52f520cce3062cd6e699cb5b24f422ace22110f84a4655e5081f59d5d4ca8c
SSDEEP

6144:Rllfe4ccDnJ820n2a+4J/gO06yklh7C2uEU3jq+vhctiviBsBL:J2Sy2Ta3JIiDBuBTtZnvL

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1600-56-0x0000000000260000-0x00000000002E5000-memory.dmp	vmprotect
behavioral1/memory/1600-57-0x0000000000260000-0x00000000002E5000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1600	1496	rundll32.exe	27
PID 1496 wrote to memory of 1600	1496	rundll32.exe	27
PID 1496 wrote to memory of 1600	1496	rundll32.exe	27
PID 1496 wrote to memory of 1600	1496	rundll32.exe	27
PID 1496 wrote to memory of 1600	1496	rundll32.exe	27
PID 1496 wrote to memory of 1600	1496	rundll32.exe	27
PID 1496 wrote to memory of 1600	1496	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\646ad5c5f3f23f7c6c078fa5b0c975f91be82e34747fbccfcce9fc23c21702ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\646ad5c5f3f23f7c6c078fa5b0c975f91be82e34747fbccfcce9fc23c21702ea.dll,#1
  2⤵
  PID:1600

memory/1600-54-0x0000000000000000-mapping.dmp

Download
memory/1600-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1600-56-0x0000000000260000-0x00000000002E5000-memory.dmp

Filesize
532KB

Download
memory/1600-57-0x0000000000260000-0x00000000002E5000-memory.dmp

Filesize
532KB

Download