d6e1de6c26e338bda3776aac8f8076b137422e92297dfb82bb31af6d749d41aa

Analysis

max time kernel
128s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 02:37

Target

d6e1de6c26e338bda3776aac8f8076b137422e92297dfb82bb31af6d749d41aa.dll
Size

253KB
MD5

0caa6962e2eb17ad020462f65a866080
SHA1

c630c1e37237f14316e929093a05a58dcd87d0cc
SHA256

d6e1de6c26e338bda3776aac8f8076b137422e92297dfb82bb31af6d749d41aa
SHA512

e51f4d8c01540702dda4140e75b12425294c5ce602117ee2a984adc013481834a34cf08dd52cded29b0a99d075cae8880f6f27dc417149b206aa9f5e940b1d51
SSDEEP

6144:CZRTW12pZj+l/7Zwe5W/mfVS9hdRK/LxhXNSbE:GaYZ8FfgWV4hmxhdSbE

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/928-133-0x0000000002290000-0x0000000002315000-memory.dmp	vmprotect
behavioral2/memory/928-134-0x0000000002290000-0x0000000002315000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 928	4788	rundll32.exe	82
PID 4788 wrote to memory of 928	4788	rundll32.exe	82
PID 4788 wrote to memory of 928	4788	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6e1de6c26e338bda3776aac8f8076b137422e92297dfb82bb31af6d749d41aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6e1de6c26e338bda3776aac8f8076b137422e92297dfb82bb31af6d749d41aa.dll,#1
  2⤵
  PID:928

memory/928-133-0x0000000002290000-0x0000000002315000-memory.dmp

Filesize
532KB

Download
memory/928-134-0x0000000002290000-0x0000000002315000-memory.dmp

Filesize
532KB

Download