8fe0b30a7ab90eb3910980cfbdbb5be0834fc3dbcb2de865a90272b5b5d45784

Analysis

max time kernel
163s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 12:42

Target

8fe0b30a7ab90eb3910980cfbdbb5be0834fc3dbcb2de865a90272b5b5d45784.dll
Size

2.4MB
MD5

ecab701beda846496fb0edadcf7ebb8a
SHA1

84823b97f3d4bbdd9695435ca8be0fccd8b713ea
SHA256

8fe0b30a7ab90eb3910980cfbdbb5be0834fc3dbcb2de865a90272b5b5d45784
SHA512

57d8dc26da3458b21de770192ec3363e6b7feed1bbf236328e83d3ac294ce30d409a4dbb934c48d84a5964b634228feafda2f5c6f5fe32924cc2cfcc2d3cd95a
SSDEEP

49152:tSm9o3PvO5awh79F+Ka4gvWl9tfVdIcerpOiP7yYX30rty4x6jjtRB6biNUaYABE:tB9oHjw7Fe4gvWl9tfTIceNPP+YXnI6a

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/2240-133-0x0000000074760000-0x00000000749E5000-memory.dmp	vmprotect
behavioral2/memory/2240-135-0x0000000074760000-0x00000000749E5000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

2240 rundll32.exe

pid	process
2240	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1800 wrote to memory of 2240	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 2240	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 2240	1800	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fe0b30a7ab90eb3910980cfbdbb5be0834fc3dbcb2de865a90272b5b5d45784.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fe0b30a7ab90eb3910980cfbdbb5be0834fc3dbcb2de865a90272b5b5d45784.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2240

memory/2240-132-0x0000000000000000-mapping.dmp

Download
memory/2240-133-0x0000000074760000-0x00000000749E5000-memory.dmp

Filesize
2.5MB

Download
memory/2240-134-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2240-135-0x0000000074760000-0x00000000749E5000-memory.dmp

Filesize
2.5MB

Download
memory/2240-136-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download