cc678421e0890137f8d8d936d1a23dd997577610c1ddbc724e911dce8407d1a2

Analysis

max time kernel
159s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:07

Target

cc678421e0890137f8d8d936d1a23dd997577610c1ddbc724e911dce8407d1a2.dll
Size

800KB
MD5

42acfabde33ddbec78c7261d8d3fe48d
SHA1

99714b08b0fc84884fc6e5f374217ddda5e5fa82
SHA256

cc678421e0890137f8d8d936d1a23dd997577610c1ddbc724e911dce8407d1a2
SHA512

64e59c93656d32c897fb4ae86df467f0f803fbde2337a9c57eb57f9f70a0f7db73653a651f99ba1945a7ad1e2df6fd870adb179c15915b9515efa51c79f410ee
SSDEEP

24576:qdXPCyXEM4jJTY2lmlxNzdKaXv9JoP+KIMB9yVj3jzY5:qtPkDW2+v3o7/B96jg

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/3940-133-0x0000000010000000-0x000000001020C000-memory.dmp	vmprotect
behavioral2/memory/3940-134-0x0000000010000000-0x000000001020C000-memory.dmp	vmprotect
behavioral2/memory/3940-138-0x0000000010000000-0x000000001020C000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4388 3940 WerFault.exe rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

3940 rundll32.exe

pid	pid_target	process	target process
4388	3940	WerFault.exe	rundll32.exe

pid	process
3940	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2612 wrote to memory of 3940	2612	rundll32.exe	rundll32.exe
PID 2612 wrote to memory of 3940	2612	rundll32.exe	rundll32.exe
PID 2612 wrote to memory of 3940	2612	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc678421e0890137f8d8d936d1a23dd997577610c1ddbc724e911dce8407d1a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc678421e0890137f8d8d936d1a23dd997577610c1ddbc724e911dce8407d1a2.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 752
    3⤵
    - Program crash
    PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3940 -ip 3940
1⤵
PID:2568

memory/3940-132-0x0000000000000000-mapping.dmp

Download
memory/3940-133-0x0000000010000000-0x000000001020C000-memory.dmp

Filesize
2.0MB

Download
memory/3940-134-0x0000000010000000-0x000000001020C000-memory.dmp

Filesize
2.0MB

Download
memory/3940-138-0x0000000010000000-0x000000001020C000-memory.dmp

Filesize
2.0MB

Download