6f5e5955cf5ad1475b1c284f499a3fb6f76f841048686498cfa6ae673789ff04

Analysis

max time kernel
115s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 23:54

Target

Imagem digital Cheque Retorno 791212-2015.dll
Size

432KB
MD5

b9d5f9ba18071f9fff619feeb2308cd8
SHA1

45ffdcbd9164b7159a0ff71c59d12294ef62c8ad
SHA256

2aa8ed19fcd57bf8c008c5f7b5a0aa9eb9f71e67e18d427f0d66b5bff569bd89
SHA512

14b78d970b33e61024ca7e821e602cfdc46bc4d7cf56862eb0d4a1f661e2cc5f1d0b266d79a2933d8377e6a932b630546365a9df300c8f00a3d35db597213a57
SSDEEP

6144:C3azg5lUyG/1Ikz/DnRJXYrJ3Dwgw1O3BZRr14w42PtHyRPQwp3Pw/d:C4KlUyELnRJX8JRr14qtpwpu

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/5036-133-0x0000000000400000-0x00000000004F8000-memory.dmp	vmprotect
behavioral2/memory/5036-134-0x0000000000400000-0x00000000004F8000-memory.dmp	vmprotect
behavioral2/memory/5036-135-0x0000000000400000-0x00000000004F8000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2816 wrote to memory of 5036	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 5036	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 5036	2816	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Imagem digital Cheque Retorno 791212-2015.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Imagem digital Cheque Retorno 791212-2015.dll",#1
  2⤵
  PID:5036

memory/5036-132-0x0000000000000000-mapping.dmp

Download
memory/5036-133-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/5036-134-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/5036-135-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download