5c3edfa93f7f1ef3c71957f488282152bd1bfe1a53d773f6b3b960928ea7f26c

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 22:38

Target

5c3edfa93f7f1ef3c71957f488282152bd1bfe1a53d773f6b3b960928ea7f26c.dll
Size

152KB
MD5

5e7149341962d92c305d66d851c64f66
SHA1

c58a51b16666069c7cb7ef5b85cf1a2486f33fb2
SHA256

5c3edfa93f7f1ef3c71957f488282152bd1bfe1a53d773f6b3b960928ea7f26c
SHA512

a45db99c93b3fcdc3b74f9b988b8e85323c2f4745911e996f3ca32325bf08dafd11720e908196495bb143b42902ddd16a19109686aabf18759570a2cc949d4d4
SSDEEP

3072:t8m+CtsQMuSfwKKgd/yKG8T5CHx0aLU3ELPm5jbPWg1vZ1ZYey+71ykY6zOzi:i3CEfwK68lCHBe1ug1vZ13Eaazi

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1220-56-0x0000000010000000-0x0000000010067000-memory.dmp	vmprotect
behavioral1/memory/1220-59-0x0000000010000000-0x0000000010067000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 892 wrote to memory of 1220	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 1220	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 1220	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 1220	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 1220	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 1220	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 1220	892	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c3edfa93f7f1ef3c71957f488282152bd1bfe1a53d773f6b3b960928ea7f26c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c3edfa93f7f1ef3c71957f488282152bd1bfe1a53d773f6b3b960928ea7f26c.dll,#1
2⤵
PID:1220

memory/1220-54-0x0000000000000000-mapping.dmp

Download
memory/1220-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1220-56-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download
memory/1220-59-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download