645fd5823b27e4d8c592888bf07056878ffa3568f2959aded51d3d95be71913e

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 03:23

Target

645fd5823b27e4d8c592888bf07056878ffa3568f2959aded51d3d95be71913e.dll
Size

627KB
MD5

67a94068ccdf4124369c8c4f795dd188
SHA1

878aa8246ae0084d1e37e810c83deee3f2371c55
SHA256

645fd5823b27e4d8c592888bf07056878ffa3568f2959aded51d3d95be71913e
SHA512

d60df03d17324450ed2caa012fa0bb1f3f3efdb47ffd91fca954effaaf64fa812d2155f5db8c1f0f1fd3d04e4578b2576e8eceeae5abe46a62ee7bfbd4e58329
SSDEEP

12288:ukZaLNryXCSWKXPl/m25EMICK5YJc+/Qps0ABzRD0xCmzJv6eZrtY4Y3Tz:HZaUXCSWKfl/m25TK/pulDsv6CrtY4Y3

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/904-56-0x00000000008E0000-0x0000000000A3D000-memory.dmp	vmprotect
behavioral1/memory/904-58-0x00000000008E0000-0x0000000000A3D000-memory.dmp	vmprotect
behavioral1/memory/904-59-0x00000000008E0000-0x0000000000A3D000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1528 wrote to memory of 904	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 904	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 904	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 904	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 904	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 904	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 904	1528	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\645fd5823b27e4d8c592888bf07056878ffa3568f2959aded51d3d95be71913e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\645fd5823b27e4d8c592888bf07056878ffa3568f2959aded51d3d95be71913e.dll,#1
2⤵
PID:904

memory/904-54-0x0000000000000000-mapping.dmp

Download
memory/904-55-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/904-56-0x00000000008E0000-0x0000000000A3D000-memory.dmp

Filesize
1.4MB

Download
memory/904-58-0x00000000008E0000-0x0000000000A3D000-memory.dmp

Filesize
1.4MB

Download
memory/904-59-0x00000000008E0000-0x0000000000A3D000-memory.dmp

Filesize
1.4MB

Download