588b7ebf1ea91c78c9b013b246b3f7d9889c67fb9118c4b84826ffa5ff106b10

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 23:10

Target

588b7ebf1ea91c78c9b013b246b3f7d9889c67fb9118c4b84826ffa5ff106b10.dll
Size

250KB
MD5

0d1c5d1f3c921075bf868c04d3f8ce90
SHA1

bb8591dcefa3325c7612472bdaef1e16dc6fc9ea
SHA256

588b7ebf1ea91c78c9b013b246b3f7d9889c67fb9118c4b84826ffa5ff106b10
SHA512

63042fbeb89af1fb179d199893f9531a22f3978c889c52a2d348bbd7e9d1574562bf641042ee0cca74e2ec5144fc1a18215d746ed76b18b2b7d5476925c54328
SSDEEP

6144:oqxwcjfk73dcA+VYAnSSDHDjz3lmnQwLpw6T6WF:oq6cy3dl+DTL1my6bF

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1204-56-0x0000000000240000-0x00000000002C4000-memory.dmp	vmprotect
behavioral1/memory/1204-57-0x0000000000240000-0x00000000002C4000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\588b7ebf1ea91c78c9b013b246b3f7d9889c67fb9118c4b84826ffa5ff106b10.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\588b7ebf1ea91c78c9b013b246b3f7d9889c67fb9118c4b84826ffa5ff106b10.dll,#1
  2⤵
  PID:1204

memory/1204-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1204-56-0x0000000000240000-0x00000000002C4000-memory.dmp

Filesize
528KB

Download
memory/1204-57-0x0000000000240000-0x00000000002C4000-memory.dmp

Filesize
528KB

Download