26a56ed7811dcff0eb79ae405c515a0f690ef368b75cea9d52b25568ac29f019

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 12:58

Target

26a56ed7811dcff0eb79ae405c515a0f690ef368b75cea9d52b25568ac29f019.dll
Size

247KB
MD5

113530c10e3a28156fe97e720d0413a0
SHA1

0136b5bc28f286aec7dfe987cc7d3ec5aa843a81
SHA256

26a56ed7811dcff0eb79ae405c515a0f690ef368b75cea9d52b25568ac29f019
SHA512

9092b38dbdb0f179e70bb160594a109019cf0259c4a09b859707bfb75ed6d195a86ed164e5afb5378d5fd4f017c05daf665fcfe56fbd989d8b4aa6b23df334af
SSDEEP

6144:hrhi+65S6mSzTf6tPArp+lbJ1YE0FutxwithTbBvp3T:hY7n8ArpMYJFKxzhhR3T

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/708-133-0x0000000000400000-0x0000000000483000-memory.dmp	vmprotect
behavioral2/memory/708-134-0x0000000000400000-0x0000000000483000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 708	4972	rundll32.exe	81
PID 4972 wrote to memory of 708	4972	rundll32.exe	81
PID 4972 wrote to memory of 708	4972	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26a56ed7811dcff0eb79ae405c515a0f690ef368b75cea9d52b25568ac29f019.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26a56ed7811dcff0eb79ae405c515a0f690ef368b75cea9d52b25568ac29f019.dll,#1
  2⤵
  PID:708

memory/708-133-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/708-134-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download