01936db2d05b34fa2d4e0bbb3623bae94dab294ba53f8611f699c972b566b653

Analysis

max time kernel
27s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:27

Target

01936db2d05b34fa2d4e0bbb3623bae94dab294ba53f8611f699c972b566b653.dll
Size

327KB
MD5

03b97729adaede0b1407c1a7cf5ecd9e
SHA1

1c1335f096217bcd722f6cc55e16c0e83db018e3
SHA256

01936db2d05b34fa2d4e0bbb3623bae94dab294ba53f8611f699c972b566b653
SHA512

fb165a8cb72b3bd8c29d89c51f44854ae1bf50c7acd26e4f0956e2edd1e4fac12a3837fee822e50c532ac1722168b0c3cac5f56bc83d821c09a51b796b1a4160
SSDEEP

6144:deOPgK19B3SfpogX/0n5WrShmVHVLVRi5kzXycsbws9/whp8b5blW/GeXt:dej28rShm5Vmb1iaQ/x

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2016-56-0x0000000041700000-0x00000000417A8000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2004 wrote to memory of 2016	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2016	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2016	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2016	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2016	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2016	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2016	2004	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01936db2d05b34fa2d4e0bbb3623bae94dab294ba53f8611f699c972b566b653.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01936db2d05b34fa2d4e0bbb3623bae94dab294ba53f8611f699c972b566b653.dll,#1
2⤵
PID:2016

memory/2016-54-0x0000000000000000-mapping.dmp

Download
memory/2016-55-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x0000000041700000-0x00000000417A8000-memory.dmp

Filesize
672KB

Download