6e7d2668425ff36ae9acc5086464fe0e43b75f739e6dad8b50637f74b76eb512

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 07:18

Target

6e7d2668425ff36ae9acc5086464fe0e43b75f739e6dad8b50637f74b76eb512.dll
Size

1.3MB
MD5

e0c9866574716c189452909a57705a64
SHA1

5c362f29398fca8655a44c68178d1e5c7fe055fd
SHA256

6e7d2668425ff36ae9acc5086464fe0e43b75f739e6dad8b50637f74b76eb512
SHA512

7096103f01ab6e289898adf640b7e8edd83371e9313f1909e444e5244817342e522b213326e2c511050ecb7acbd9385669dbbf5bf0c0ff0a6dc2a14aaba18519
SSDEEP

24576:D7ZU9kI0yRzQRW3OeEaKwSfpcUJAnlpxLdeEZ0am9RFYjMictq+paZTxi:/ZU9r9RzQMTEaKrpceAfbeG0amKjUr84

Score

8^/10

vmprotect

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

4 1812 rundll32.exe

flow	pid	process
4	1812	rundll32.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1812-56-0x0000000010000000-0x00000000102E3000-memory.dmp	vmprotect
behavioral1/memory/1812-58-0x0000000010000000-0x00000000102E3000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e7d2668425ff36ae9acc5086464fe0e43b75f739e6dad8b50637f74b76eb512.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e7d2668425ff36ae9acc5086464fe0e43b75f739e6dad8b50637f74b76eb512.dll,#1
2⤵
- Blocklisted process makes network request
PID:1812

memory/1812-54-0x0000000000000000-mapping.dmp

Download
memory/1812-55-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1812-56-0x0000000010000000-0x00000000102E3000-memory.dmp

Filesize
2.9MB

Download
memory/1812-58-0x0000000010000000-0x00000000102E3000-memory.dmp

Filesize
2.9MB

Download