8d8de3e3f7fe8f99d64acbcf98ca66637f262abdb8cc8f6ce070acf97ebb807f

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 14:11

Target

8d8de3e3f7fe8f99d64acbcf98ca66637f262abdb8cc8f6ce070acf97ebb807f.dll
Size

632KB
MD5

7735ef8958ec1170abd7839d98010f56
SHA1

1670c6a11390aa9e34975d71a8a3ec20de146758
SHA256

8d8de3e3f7fe8f99d64acbcf98ca66637f262abdb8cc8f6ce070acf97ebb807f
SHA512

f3184274835dbcedf3cde8d8dcc06cd71a324081127017b07f7ac4b0e529689e3c121f1014eb963b3840dc0f3a9d06568a234e8b0e836f55d8a97658e6bee6aa
SSDEEP

12288:pCxF93DgvgyMK48On/OHoGDQYm3++6Hi1BkQDVNRh52auqeV17:pWh+g58OqoGEYWH6C1BkCRzuq8

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/956-56-0x00000000007E0000-0x000000000093D000-memory.dmp	vmprotect
behavioral1/memory/956-58-0x00000000007E0000-0x000000000093D000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 956	2040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d8de3e3f7fe8f99d64acbcf98ca66637f262abdb8cc8f6ce070acf97ebb807f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d8de3e3f7fe8f99d64acbcf98ca66637f262abdb8cc8f6ce070acf97ebb807f.dll,#1
  2⤵
  PID:956

memory/956-54-0x0000000000000000-mapping.dmp

Download
memory/956-55-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/956-56-0x00000000007E0000-0x000000000093D000-memory.dmp

Filesize
1.4MB

Download
memory/956-58-0x00000000007E0000-0x000000000093D000-memory.dmp

Filesize
1.4MB

Download