2aa8ed19fcd57bf8c008c5f7b5a0aa9eb9f71e67e18d427f0d66b5bff569bd89

Analysis

max time kernel
29s
max time network
63s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 23:54

Target

2aa8ed19fcd57bf8c008c5f7b5a0aa9eb9f71e67e18d427f0d66b5bff569bd89.dll
Size

432KB
MD5

b9d5f9ba18071f9fff619feeb2308cd8
SHA1

45ffdcbd9164b7159a0ff71c59d12294ef62c8ad
SHA256

2aa8ed19fcd57bf8c008c5f7b5a0aa9eb9f71e67e18d427f0d66b5bff569bd89
SHA512

14b78d970b33e61024ca7e821e602cfdc46bc4d7cf56862eb0d4a1f661e2cc5f1d0b266d79a2933d8377e6a932b630546365a9df300c8f00a3d35db597213a57
SSDEEP

6144:C3azg5lUyG/1Ikz/DnRJXYrJ3Dwgw1O3BZRr14w42PtHyRPQwp3Pw/d:C4KlUyELnRJX8JRr14qtpwpu

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/856-56-0x0000000000280000-0x0000000000378000-memory.dmp	vmprotect
behavioral1/memory/856-57-0x0000000000280000-0x0000000000378000-memory.dmp	vmprotect
behavioral1/memory/856-58-0x0000000000280000-0x0000000000378000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 884 wrote to memory of 856	884	rundll32.exe	rundll32.exe
PID 884 wrote to memory of 856	884	rundll32.exe	rundll32.exe
PID 884 wrote to memory of 856	884	rundll32.exe	rundll32.exe
PID 884 wrote to memory of 856	884	rundll32.exe	rundll32.exe
PID 884 wrote to memory of 856	884	rundll32.exe	rundll32.exe
PID 884 wrote to memory of 856	884	rundll32.exe	rundll32.exe
PID 884 wrote to memory of 856	884	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aa8ed19fcd57bf8c008c5f7b5a0aa9eb9f71e67e18d427f0d66b5bff569bd89.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aa8ed19fcd57bf8c008c5f7b5a0aa9eb9f71e67e18d427f0d66b5bff569bd89.dll,#1
2⤵
PID:856

memory/856-54-0x0000000000000000-mapping.dmp

Download
memory/856-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/856-56-0x0000000000280000-0x0000000000378000-memory.dmp

Filesize
992KB

Download
memory/856-57-0x0000000000280000-0x0000000000378000-memory.dmp

Filesize
992KB

Download
memory/856-58-0x0000000000280000-0x0000000000378000-memory.dmp

Filesize
992KB

Download