25920f7c76d2b1a2e930e715aa637bc6031f79f5af82c56e314f77fdd5f3f0de

Analysis

max time kernel
160s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 04:56

Target

25920f7c76d2b1a2e930e715aa637bc6031f79f5af82c56e314f77fdd5f3f0de.dll
Size

120KB
MD5

ddeaf23ab4dbcdff71ba3a8c47ac6280
SHA1

d71a2ce327c07e3e2f742d0b57ae4429d49c29e9
SHA256

25920f7c76d2b1a2e930e715aa637bc6031f79f5af82c56e314f77fdd5f3f0de
SHA512

badd59ea50299bb058d99d5a3b20ee08dadf3860592f05ae5744eec8e56164a911ecad3510cd68fa02dae64363b8e5a87b11d929a6793d115e0bfef45cd5daa8
SSDEEP

3072:U8br6KLnXnCUasJvM+mxxWXEoI5QX7c8f8M0BMiOCNn:9VLXnCkpGx6Ex67cT4

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/4156-133-0x0000000068BE0000-0x0000000068C1F000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4844 wrote to memory of 4156	4844	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 4156	4844	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 4156	4844	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25920f7c76d2b1a2e930e715aa637bc6031f79f5af82c56e314f77fdd5f3f0de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25920f7c76d2b1a2e930e715aa637bc6031f79f5af82c56e314f77fdd5f3f0de.dll,#1
  2⤵
  PID:4156

memory/4156-132-0x0000000000000000-mapping.dmp

Download
memory/4156-133-0x0000000068BE0000-0x0000000068C1F000-memory.dmp

Filesize
252KB

Download