4aa8217bdbd3be9f7e0556d9de494344a7fa577bea0c732565b086dc8da92e30

Analysis

max time kernel
93s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:49

Target

4aa8217bdbd3be9f7e0556d9de494344a7fa577bea0c732565b086dc8da92e30.dll
Size

632KB
MD5

2e84eb979ab543fcd6e9719e65d298f3
SHA1

6e55a84632d31361a22b9b7acf2f2ef472d296be
SHA256

4aa8217bdbd3be9f7e0556d9de494344a7fa577bea0c732565b086dc8da92e30
SHA512

b45e1c6748d12707dc82a4c862cc4d245df28fded404ebc1fa57e7e04d3f59e89474534c9babc4e95a5b8ac6cea5db04a36b806fb927e205a5ecefa43096f117
SSDEEP

12288:YnY4Y3TzW3Wp9ZZ8DDzt1A9it5bMGR09OxVa6C3lGoAJTC6jwfv:MY4YDzWWp9ZGfzt1AsP7RnbwVuuDv

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/4372-133-0x0000000000400000-0x000000000055D000-memory.dmp	vmprotect
behavioral2/memory/4372-135-0x0000000000400000-0x000000000055D000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4324 wrote to memory of 4372	4324	rundll32.exe	rundll32.exe
PID 4324 wrote to memory of 4372	4324	rundll32.exe	rundll32.exe
PID 4324 wrote to memory of 4372	4324	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4aa8217bdbd3be9f7e0556d9de494344a7fa577bea0c732565b086dc8da92e30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4324

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4aa8217bdbd3be9f7e0556d9de494344a7fa577bea0c732565b086dc8da92e30.dll,#1
2⤵
PID:4372

memory/4372-132-0x0000000000000000-mapping.dmp

Download
memory/4372-133-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/4372-135-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download