d0b9f65f5d01e60fea1e3418154a1abd69fc05bf5778a4d205a62c1cc9b1d287

Analysis

max time kernel
25s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 23:10

Target

d0b9f65f5d01e60fea1e3418154a1abd69fc05bf5778a4d205a62c1cc9b1d287.dll
Size

250KB
MD5

0c7dac893d9321530b54f365cf53cd90
SHA1

6e0dec1881a76f7d3b4109cb97c43141330e5ae0
SHA256

d0b9f65f5d01e60fea1e3418154a1abd69fc05bf5778a4d205a62c1cc9b1d287
SHA512

730e1ec9a73f22970c78b5b0dad9261c44b2f34a95815301ec8750942cb8d9d18d66be91e8e5861fc08bb0ca65dccc6187ba74a1ec3d6f352af85945ad3f1b2a
SSDEEP

6144:oqxwcjfk73dcA+VYAnSSDHDjz3lmnQwLpw6T6WS:oq6cy3dl+DTL1my6bS

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1668-56-0x0000000001BD0000-0x0000000001C54000-memory.dmp	vmprotect
behavioral1/memory/1668-57-0x0000000001BD0000-0x0000000001C54000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28
PID 2016 wrote to memory of 1668	2016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0b9f65f5d01e60fea1e3418154a1abd69fc05bf5778a4d205a62c1cc9b1d287.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0b9f65f5d01e60fea1e3418154a1abd69fc05bf5778a4d205a62c1cc9b1d287.dll,#1
  2⤵
  PID:1668

memory/1668-54-0x0000000000000000-mapping.dmp

Download
memory/1668-55-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1668-56-0x0000000001BD0000-0x0000000001C54000-memory.dmp

Filesize
528KB

Download
memory/1668-57-0x0000000001BD0000-0x0000000001C54000-memory.dmp

Filesize
528KB

Download