e667c6755ae3a4729cd292f4eb4702f8ab1f802578a1b74d0acdb2bd862eca3c

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:46

Target

e667c6755ae3a4729cd292f4eb4702f8ab1f802578a1b74d0acdb2bd862eca3c.dll
Size

466KB
MD5

9cbfe6ca29b23aadddc18e4da670fe4d
SHA1

1206bed9e5f23b69a61bc965c1d6f9d976b11256
SHA256

e667c6755ae3a4729cd292f4eb4702f8ab1f802578a1b74d0acdb2bd862eca3c
SHA512

3bb32c0795e3a647cd9da4551eddbdc06ff37a9372bd0f7e584e22e369736eae9ca5022f84df9f10b6db64d01b336bbd08dc13fb1835175e3622f7ec87aad5e6
SSDEEP

6144:bnGsuyYMOX8ns/w72gChoiMjsYlsdh6VRAoJSb9nN7XYSmQkVPpBVJqHliklXz3g:+MOX8mgChoinYAaDJiXYSBk1il/tzYb

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1976-56-0x0000000001D80000-0x0000000001E8D000-memory.dmp	vmprotect
behavioral1/memory/1976-58-0x0000000001D80000-0x0000000001E8D000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1060 wrote to memory of 1976	1060	rundll32.exe	rundll32.exe
PID 1060 wrote to memory of 1976	1060	rundll32.exe	rundll32.exe
PID 1060 wrote to memory of 1976	1060	rundll32.exe	rundll32.exe
PID 1060 wrote to memory of 1976	1060	rundll32.exe	rundll32.exe
PID 1060 wrote to memory of 1976	1060	rundll32.exe	rundll32.exe
PID 1060 wrote to memory of 1976	1060	rundll32.exe	rundll32.exe
PID 1060 wrote to memory of 1976	1060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e667c6755ae3a4729cd292f4eb4702f8ab1f802578a1b74d0acdb2bd862eca3c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e667c6755ae3a4729cd292f4eb4702f8ab1f802578a1b74d0acdb2bd862eca3c.dll,#1
2⤵
PID:1976

memory/1976-54-0x0000000000000000-mapping.dmp

Download
memory/1976-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/1976-56-0x0000000001D80000-0x0000000001E8D000-memory.dmp

Filesize
1.1MB

Download
memory/1976-58-0x0000000001D80000-0x0000000001E8D000-memory.dmp

Filesize
1.1MB

Download