aa0575bcc024f6af47dcd9e988a3866ea9e57d451bb6b2236c2a43e4ac619af3

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 13:21

Target

aa0575bcc024f6af47dcd9e988a3866ea9e57d451bb6b2236c2a43e4ac619af3.dll
Size

256KB
MD5

11721a016f6a21ee2bc7340ed78d8480
SHA1

77cb0d3e5a4ca50963cd63fa88d36a49e596a63c
SHA256

aa0575bcc024f6af47dcd9e988a3866ea9e57d451bb6b2236c2a43e4ac619af3
SHA512

6dcace1795f9a5faeeb340f5b4b41e733c24e52ffe5adcf6a81a42cc7c3f3844061dafc0cc6ec1bf726c4a73e1e6e805fbf9f8364e626d6a2aad1d5deeed9bdd
SSDEEP

6144:jKoEIUvadsnqcwMStIwBKVig/zm204FDAEH4:BEgF7KpbmmFDJH4

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4208-133-0x00000000009E0000-0x0000000000A67000-memory.dmp	vmprotect
behavioral2/memory/4208-134-0x00000000009E0000-0x0000000000A67000-memory.dmp	vmprotect
behavioral2/memory/4208-135-0x00000000009E0000-0x0000000000A67000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 4208	2608	rundll32.exe	80
PID 2608 wrote to memory of 4208	2608	rundll32.exe	80
PID 2608 wrote to memory of 4208	2608	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0575bcc024f6af47dcd9e988a3866ea9e57d451bb6b2236c2a43e4ac619af3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0575bcc024f6af47dcd9e988a3866ea9e57d451bb6b2236c2a43e4ac619af3.dll,#1
  2⤵
  PID:4208

memory/4208-133-0x00000000009E0000-0x0000000000A67000-memory.dmp

Filesize
540KB

Download
memory/4208-134-0x00000000009E0000-0x0000000000A67000-memory.dmp

Filesize
540KB

Download
memory/4208-135-0x00000000009E0000-0x0000000000A67000-memory.dmp

Filesize
540KB

Download