8fe0b30a7ab90eb3910980cfbdbb5be0834fc3dbcb2de865a90272b5b5d45784

Analysis

max time kernel
24s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 12:42

Target

8fe0b30a7ab90eb3910980cfbdbb5be0834fc3dbcb2de865a90272b5b5d45784.dll
Size

2.4MB
MD5

ecab701beda846496fb0edadcf7ebb8a
SHA1

84823b97f3d4bbdd9695435ca8be0fccd8b713ea
SHA256

8fe0b30a7ab90eb3910980cfbdbb5be0834fc3dbcb2de865a90272b5b5d45784
SHA512

57d8dc26da3458b21de770192ec3363e6b7feed1bbf236328e83d3ac294ce30d409a4dbb934c48d84a5964b634228feafda2f5c6f5fe32924cc2cfcc2d3cd95a
SSDEEP

49152:tSm9o3PvO5awh79F+Ka4gvWl9tfVdIcerpOiP7yYX30rty4x6jjtRB6biNUaYABE:tB9oHjw7Fe4gvWl9tfTIceNPP+YXnI6a

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/996-56-0x0000000074780000-0x0000000074A05000-memory.dmp	vmprotect
behavioral1/memory/996-58-0x0000000074780000-0x0000000074A05000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

996 rundll32.exe

pid	process
996	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1904 wrote to memory of 996	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 996	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 996	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 996	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 996	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 996	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 996	1904	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fe0b30a7ab90eb3910980cfbdbb5be0834fc3dbcb2de865a90272b5b5d45784.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fe0b30a7ab90eb3910980cfbdbb5be0834fc3dbcb2de865a90272b5b5d45784.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:996

memory/996-54-0x0000000000000000-mapping.dmp

Download
memory/996-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/996-56-0x0000000074780000-0x0000000074A05000-memory.dmp

Filesize
2.5MB

Download
memory/996-57-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/996-58-0x0000000074780000-0x0000000074A05000-memory.dmp

Filesize
2.5MB

Download
memory/996-59-0x00000000744F0000-0x0000000074775000-memory.dmp

Filesize
2.5MB

Download
memory/996-60-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download