aa0575bcc024f6af47dcd9e988a3866ea9e57d451bb6b2236c2a43e4ac619af3

Analysis

max time kernel
29s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 13:21

Target

aa0575bcc024f6af47dcd9e988a3866ea9e57d451bb6b2236c2a43e4ac619af3.dll
Size

256KB
MD5

11721a016f6a21ee2bc7340ed78d8480
SHA1

77cb0d3e5a4ca50963cd63fa88d36a49e596a63c
SHA256

aa0575bcc024f6af47dcd9e988a3866ea9e57d451bb6b2236c2a43e4ac619af3
SHA512

6dcace1795f9a5faeeb340f5b4b41e733c24e52ffe5adcf6a81a42cc7c3f3844061dafc0cc6ec1bf726c4a73e1e6e805fbf9f8364e626d6a2aad1d5deeed9bdd
SSDEEP

6144:jKoEIUvadsnqcwMStIwBKVig/zm204FDAEH4:BEgF7KpbmmFDJH4

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/612-56-0x0000000000400000-0x0000000000487000-memory.dmp	vmprotect
behavioral1/memory/612-57-0x0000000000400000-0x0000000000487000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 612	1724	rundll32.exe	27
PID 1724 wrote to memory of 612	1724	rundll32.exe	27
PID 1724 wrote to memory of 612	1724	rundll32.exe	27
PID 1724 wrote to memory of 612	1724	rundll32.exe	27
PID 1724 wrote to memory of 612	1724	rundll32.exe	27
PID 1724 wrote to memory of 612	1724	rundll32.exe	27
PID 1724 wrote to memory of 612	1724	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0575bcc024f6af47dcd9e988a3866ea9e57d451bb6b2236c2a43e4ac619af3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0575bcc024f6af47dcd9e988a3866ea9e57d451bb6b2236c2a43e4ac619af3.dll,#1
  2⤵
  PID:612

memory/612-55-0x0000000076161000-0x0000000076163000-memory.dmp

Filesize
8KB

Download
memory/612-56-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/612-57-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download