ac50a2f233bed117ea4aab2ec0437e1d04661664f24f1a59cfd29c9fad16f77a

Analysis

max time kernel
182s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:10

Target

mxdbl.pc6.0831/冒险伴侣0831/Partner.dll
Size

1000KB
MD5

759d7f9a47b9f458e19b93eed4ce0ba6
SHA1

e31e73b0aca7d80301ad61f65330b3ffd88cc88e
SHA256

24198c3ead664d7688a4d05d1356ae4774f15a79bea809558c73599bd9ee18c1
SHA512

eee70fd006710f80f2caa89ca7715377df80daaeabe2197768979e7f7742c9d997538f73a434268b014cb4acc17b36bd803c145f26aaf47dfb1ecb66b59e10ec
SSDEEP

24576:sojABVSSdYxUNvUJP4rmBNDm+QtgAQtTJDnwfyACmlvUyeugfaLQPfNcj:1jsHYOJrmXDmCAQB9wJCe8pm8Pm

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral8/memory/1432-133-0x0000000010000000-0x000000001035A000-memory.dmp	vmprotect
behavioral8/memory/1432-134-0x0000000010000000-0x000000001035A000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

1432 rundll32.exe

pid	process
1432	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2548 wrote to memory of 1432	2548	rundll32.exe	rundll32.exe
PID 2548 wrote to memory of 1432	2548	rundll32.exe	rundll32.exe
PID 2548 wrote to memory of 1432	2548	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mxdbl.pc6.0831\冒险伴侣0831\Partner.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mxdbl.pc6.0831\冒险伴侣0831\Partner.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1432

memory/1432-132-0x0000000000000000-mapping.dmp

Download
memory/1432-133-0x0000000010000000-0x000000001035A000-memory.dmp

Filesize
3.4MB

Download
memory/1432-134-0x0000000010000000-0x000000001035A000-memory.dmp

Filesize
3.4MB

Download