ae6cfa14d2d1343db43fb997b5ba153b7954d0de00d6a0ff4b2dbbe9ce444b26

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 13:20

Target

ae6cfa14d2d1343db43fb997b5ba153b7954d0de00d6a0ff4b2dbbe9ce444b26.dll
Size

848KB
MD5

01a17cc00fdcc69afdce0ab234730fa0
SHA1

d1870cf0a5ff8c1ce09982ac51f806c5119337f7
SHA256

ae6cfa14d2d1343db43fb997b5ba153b7954d0de00d6a0ff4b2dbbe9ce444b26
SHA512

978434ef46f8af02b28be290522c6de1ded73eaf8c44d5f2329655995158266b81e8647c2be1b84e0b3fec30b4aaf01ba315633ed4d17e1e6ecac415da7e4d21
SSDEEP

24576:b+yw44EUzlQKI6Y9/hMY78DksUXOhHdPTv1F:b+yxY/I6+v784sUXsJhF

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4956-133-0x0000000000400000-0x00000000005A4000-memory.dmp	vmprotect
behavioral2/memory/4956-134-0x0000000000400000-0x00000000005A4000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4956	4872	rundll32.exe	80
PID 4872 wrote to memory of 4956	4872	rundll32.exe	80
PID 4872 wrote to memory of 4956	4872	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae6cfa14d2d1343db43fb997b5ba153b7954d0de00d6a0ff4b2dbbe9ce444b26.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae6cfa14d2d1343db43fb997b5ba153b7954d0de00d6a0ff4b2dbbe9ce444b26.dll,#1
  2⤵
  PID:4956

memory/4956-133-0x0000000000400000-0x00000000005A4000-memory.dmp

Filesize
1.6MB

Download
memory/4956-134-0x0000000000400000-0x00000000005A4000-memory.dmp

Filesize
1.6MB

Download