901b8c6899cac453ff0215a3ab1f89e96bc1987df07676368ed8d3292db76bde

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 03:42

Target

901b8c6899cac453ff0215a3ab1f89e96bc1987df07676368ed8d3292db76bde.dll
Size

247KB
MD5

03451b243b868f6c10b869cfaa4fa0c0
SHA1

b58ff9298ce3ffd94efe0db856b3129a3873efd2
SHA256

901b8c6899cac453ff0215a3ab1f89e96bc1987df07676368ed8d3292db76bde
SHA512

4776531fe03ef24661fe5b61730b8a30477e785bfcaa1040a9bb321e69a60fc05e1f0e598bd1eb5e76b88208a2902cf039d5faf0f3fd6fce7d70ffeac4d96334
SSDEEP

6144:/sIxMBM5cIpqXIGBWPHprSYpwItMNTUDN/T+wv:z1qCLHp+YpwIttDN/T+wv

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/5048-133-0x00000000022D0000-0x0000000002353000-memory.dmp	vmprotect
behavioral2/memory/5048-134-0x00000000022D0000-0x0000000002353000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 5048	4920	rundll32.exe	83
PID 4920 wrote to memory of 5048	4920	rundll32.exe	83
PID 4920 wrote to memory of 5048	4920	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\901b8c6899cac453ff0215a3ab1f89e96bc1987df07676368ed8d3292db76bde.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\901b8c6899cac453ff0215a3ab1f89e96bc1987df07676368ed8d3292db76bde.dll,#1
  2⤵
  PID:5048

memory/5048-133-0x00000000022D0000-0x0000000002353000-memory.dmp

Filesize
524KB

Download
memory/5048-134-0x00000000022D0000-0x0000000002353000-memory.dmp

Filesize
524KB

Download