e18cc6d5fa5ae439e38f9aa5a8e414e434fa9a0199ecc781df3662a3764268da

Analysis

max time kernel
28s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:46

Target

e18cc6d5fa5ae439e38f9aa5a8e414e434fa9a0199ecc781df3662a3764268da.dll
Size

48KB
MD5

9463be1c944b5ca3fa2ebc3a772d1981
SHA1

07f1e2bbb3c782e0428ff4f432a097a29c9f856e
SHA256

e18cc6d5fa5ae439e38f9aa5a8e414e434fa9a0199ecc781df3662a3764268da
SHA512

f9740f972bfbc50d2c336940d0b96662f74a07c95211a3ce20206a85b77f242a58b1363dcf5868c6e7e059024dae62c680de72f59bbdd288f850ed56260709b4
SSDEEP

768:TplJFsLFGVz7WBruWvaEbNQUZWf05ByD7MTh77knLYZTaSw7AT0rC5Dy:VlCworHJNhFB+IX0LIa77AwrC5Dy

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/964-56-0x0000000010000000-0x0000000010016000-memory.dmp	vmprotect
behavioral1/memory/964-58-0x0000000010000000-0x0000000010016000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

584 964 WerFault.exe rundll32.exe

pid	pid_target	process	target process
584	964	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 964	976	rundll32.exe	rundll32.exe
PID 964 wrote to memory of 584	964	rundll32.exe	WerFault.exe
PID 964 wrote to memory of 584	964	rundll32.exe	WerFault.exe
PID 964 wrote to memory of 584	964	rundll32.exe	WerFault.exe
PID 964 wrote to memory of 584	964	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e18cc6d5fa5ae439e38f9aa5a8e414e434fa9a0199ecc781df3662a3764268da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e18cc6d5fa5ae439e38f9aa5a8e414e434fa9a0199ecc781df3662a3764268da.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 416
3⤵
- Program crash
PID:584

memory/584-57-0x0000000000000000-mapping.dmp

Download
memory/964-54-0x0000000000000000-mapping.dmp

Download
memory/964-55-0x0000000075E61000-0x0000000075E63000-memory.dmp

Filesize
8KB

Download
memory/964-56-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/964-58-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download