558087a8f393b0ef4a70088423acf70f6ed01702f5f08257dc4e24edfb71c999

Analysis

max time kernel
13s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:51

Target

558087a8f393b0ef4a70088423acf70f6ed01702f5f08257dc4e24edfb71c999.dll
Size

1008KB
MD5

435c6595535615c27a72b47f89365afa
SHA1

df36550d7ab2ed82dca174dd840b30a0dc9588e1
SHA256

558087a8f393b0ef4a70088423acf70f6ed01702f5f08257dc4e24edfb71c999
SHA512

a4c1af010c46057216a01aec6bae3371488962dd8b152fb7d38a47375361140016dfe5d8847304d4d17ac0c792666e77b0ae4ae34b385548e865ed8359156d3f
SSDEEP

24576:Pj3nylUqqRp//c88uu/8OeMVYrC8V+fmM8Tr:PrSUn//E2uVVYrLVZp

Score

8^/10

vmprotect

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1348-56-0x0000000010000000-0x0000000010272000-memory.dmp	vmprotect
behavioral1/memory/1348-57-0x0000000010000000-0x0000000010272000-memory.dmp	vmprotect
behavioral1/memory/1348-58-0x0000000010000000-0x0000000010272000-memory.dmp	vmprotect
behavioral1/memory/1348-59-0x0000000010000000-0x0000000010272000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

1348 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1348 rundll32.exe

pid	process
1348	rundll32.exe

pid	process
1348	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1808 wrote to memory of 1348	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1348	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1348	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1348	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1348	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1348	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1348	1808	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\558087a8f393b0ef4a70088423acf70f6ed01702f5f08257dc4e24edfb71c999.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

memory/1348-54-0x0000000000000000-mapping.dmp

Download
memory/1348-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1348-56-0x0000000010000000-0x0000000010272000-memory.dmp

Filesize
2.4MB

Download
memory/1348-57-0x0000000010000000-0x0000000010272000-memory.dmp

Filesize
2.4MB

Download
memory/1348-58-0x0000000010000000-0x0000000010272000-memory.dmp

Filesize
2.4MB

Download
memory/1348-59-0x0000000010000000-0x0000000010272000-memory.dmp

Filesize
2.4MB

Download