cc678421e0890137f8d8d936d1a23dd997577610c1ddbc724e911dce8407d1a2

Analysis

max time kernel
30s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:07

Target

cc678421e0890137f8d8d936d1a23dd997577610c1ddbc724e911dce8407d1a2.dll
Size

800KB
MD5

42acfabde33ddbec78c7261d8d3fe48d
SHA1

99714b08b0fc84884fc6e5f374217ddda5e5fa82
SHA256

cc678421e0890137f8d8d936d1a23dd997577610c1ddbc724e911dce8407d1a2
SHA512

64e59c93656d32c897fb4ae86df467f0f803fbde2337a9c57eb57f9f70a0f7db73653a651f99ba1945a7ad1e2df6fd870adb179c15915b9515efa51c79f410ee
SSDEEP

24576:qdXPCyXEM4jJTY2lmlxNzdKaXv9JoP+KIMB9yVj3jzY5:qtPkDW2+v3o7/B96jg

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1788-56-0x0000000010000000-0x000000001020C000-memory.dmp	vmprotect
behavioral1/memory/1788-61-0x0000000010000000-0x000000001020C000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1712 1788 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1788 rundll32.exe

pid	pid_target	process	target process
1712	1788	WerFault.exe	rundll32.exe

pid	process
1788	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1112 wrote to memory of 1788	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1788	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1788	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1788	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1788	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1788	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1788	1112	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 1712	1788	rundll32.exe	WerFault.exe
PID 1788 wrote to memory of 1712	1788	rundll32.exe	WerFault.exe
PID 1788 wrote to memory of 1712	1788	rundll32.exe	WerFault.exe
PID 1788 wrote to memory of 1712	1788	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc678421e0890137f8d8d936d1a23dd997577610c1ddbc724e911dce8407d1a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 304
3⤵
- Program crash
PID:1712

memory/1712-60-0x0000000000000000-mapping.dmp

Download
memory/1788-54-0x0000000000000000-mapping.dmp

Download
memory/1788-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1788-56-0x0000000010000000-0x000000001020C000-memory.dmp

Filesize
2.0MB

Download
memory/1788-61-0x0000000010000000-0x000000001020C000-memory.dmp

Filesize
2.0MB

Download