2aa8ed19fcd57bf8c008c5f7b5a0aa9eb9f71e67e18d427f0d66b5bff569bd89

Analysis

max time kernel
174s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 23:54

Target

2aa8ed19fcd57bf8c008c5f7b5a0aa9eb9f71e67e18d427f0d66b5bff569bd89.dll
Size

432KB
MD5

b9d5f9ba18071f9fff619feeb2308cd8
SHA1

45ffdcbd9164b7159a0ff71c59d12294ef62c8ad
SHA256

2aa8ed19fcd57bf8c008c5f7b5a0aa9eb9f71e67e18d427f0d66b5bff569bd89
SHA512

14b78d970b33e61024ca7e821e602cfdc46bc4d7cf56862eb0d4a1f661e2cc5f1d0b266d79a2933d8377e6a932b630546365a9df300c8f00a3d35db597213a57
SSDEEP

6144:C3azg5lUyG/1Ikz/DnRJXYrJ3Dwgw1O3BZRr14w42PtHyRPQwp3Pw/d:C4KlUyELnRJX8JRr14qtpwpu

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/1264-133-0x0000000001FA0000-0x0000000002098000-memory.dmp	vmprotect
behavioral2/memory/1264-134-0x0000000001FA0000-0x0000000002098000-memory.dmp	vmprotect
behavioral2/memory/1264-135-0x0000000001FA0000-0x0000000002098000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1124 wrote to memory of 1264	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1264	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1264	1124	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aa8ed19fcd57bf8c008c5f7b5a0aa9eb9f71e67e18d427f0d66b5bff569bd89.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aa8ed19fcd57bf8c008c5f7b5a0aa9eb9f71e67e18d427f0d66b5bff569bd89.dll,#1
2⤵
PID:1264

memory/1264-132-0x0000000000000000-mapping.dmp

Download
memory/1264-133-0x0000000001FA0000-0x0000000002098000-memory.dmp

Filesize
992KB

Download
memory/1264-134-0x0000000001FA0000-0x0000000002098000-memory.dmp

Filesize
992KB

Download
memory/1264-135-0x0000000001FA0000-0x0000000002098000-memory.dmp

Filesize
992KB

Download