278fa506ce8852d95c5c6c37764786378319c8d0324f09896abd63cb0899d7f5

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 03:42

Target

278fa506ce8852d95c5c6c37764786378319c8d0324f09896abd63cb0899d7f5.dll
Size

247KB
MD5

0c5afe394e95835fc7d366b4157d73d0
SHA1

b50e3ef03ea492cf9b4c5e16d69b6ddfe007a723
SHA256

278fa506ce8852d95c5c6c37764786378319c8d0324f09896abd63cb0899d7f5
SHA512

cb3c473f27f021099aeb791fd6b731ab114cfd9e91c76b3d9041da699d7ee07b5ea95bf2d4fd0223a188abc4cc3cb43ed97aff9fff4b46489e9f4a2d37fe5f06
SSDEEP

6144:/sIxMBM5cIpqXIGBWPHprSYpwItMNTUDN/T+wY:z1qCLHp+YpwIttDN/T+wY

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3012-133-0x0000000000400000-0x0000000000483000-memory.dmp	vmprotect
behavioral2/memory/3012-134-0x0000000000400000-0x0000000000483000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 3012	3704	rundll32.exe	82
PID 3704 wrote to memory of 3012	3704	rundll32.exe	82
PID 3704 wrote to memory of 3012	3704	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\278fa506ce8852d95c5c6c37764786378319c8d0324f09896abd63cb0899d7f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\278fa506ce8852d95c5c6c37764786378319c8d0324f09896abd63cb0899d7f5.dll,#1
  2⤵
  PID:3012

memory/3012-133-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3012-134-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download