8591627ba21620fcf45cf0f3b9e44fc90b33b0edf4387371fdd11635e3c16965

Analysis

max time kernel
79s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 23:21

Target

8591627ba21620fcf45cf0f3b9e44fc90b33b0edf4387371fdd11635e3c16965.dll
Size

170KB
MD5

4610f9d99f825d07deff4df1f2c9f610
SHA1

93ba5f352ca7700b5acab02bb625ba575a052853
SHA256

8591627ba21620fcf45cf0f3b9e44fc90b33b0edf4387371fdd11635e3c16965
SHA512

3f05e4d830ecf3a8bf05ee271c0c2c5524c081580047be87bd0251b6bacf8bd18c4f1f2eecd7ced1e7c00fdcabfe6255ccec1760b95db0a61d6870590638dc33
SSDEEP

3072:ETtvejdXwDj5cciTeLOjRrJyRQFmHftiqibIojqlfI1+EWvqj:S2XPbGO1JSIwftiqisoelfVa

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/3168-133-0x00000000751E0000-0x0000000075211000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

3168 rundll32.exe

pid	process
3168	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3260 wrote to memory of 3168	3260	rundll32.exe	rundll32.exe
PID 3260 wrote to memory of 3168	3260	rundll32.exe	rundll32.exe
PID 3260 wrote to memory of 3168	3260	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8591627ba21620fcf45cf0f3b9e44fc90b33b0edf4387371fdd11635e3c16965.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3260

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8591627ba21620fcf45cf0f3b9e44fc90b33b0edf4387371fdd11635e3c16965.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3168

memory/3168-132-0x0000000000000000-mapping.dmp

Download
memory/3168-133-0x00000000751E0000-0x0000000075211000-memory.dmp

Filesize
196KB

Download