bcd84ff0e24222667a16997057b55c872f66fe4d1e84e60ca5d21c300ca8381c

Analysis

max time kernel
172s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:33

Target

bcd84ff0e24222667a16997057b55c872f66fe4d1e84e60ca5d21c300ca8381c.dll
Size

170KB
MD5

50d3088a47affaa543aee95de20b6e80
SHA1

9605fdb3fd2a4f21b18942ebb0f793f7e6970f88
SHA256

bcd84ff0e24222667a16997057b55c872f66fe4d1e84e60ca5d21c300ca8381c
SHA512

5f6026bfbbed4db8eee87faeb0c64d7a29a53070eff6cc36c5864d980b8261bf94a291606c3f43829c6de52c21839478298612885906ca2dd5da68071264cb14
SSDEEP

3072:WTtvejdXwDj5cciTeLOjRrJyRQFmHftiqibIojqlfI1+EWvqj:w2XPbGO1JSIwftiqisoelfVa

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/3456-133-0x0000000075240000-0x0000000075271000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

3456 rundll32.exe

pid	process
3456	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1272 wrote to memory of 3456	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 3456	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 3456	1272	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcd84ff0e24222667a16997057b55c872f66fe4d1e84e60ca5d21c300ca8381c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcd84ff0e24222667a16997057b55c872f66fe4d1e84e60ca5d21c300ca8381c.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3456

memory/3456-132-0x0000000000000000-mapping.dmp

Download
memory/3456-133-0x0000000075240000-0x0000000075271000-memory.dmp

Filesize
196KB

Download