3c258371f62be9b71c9411e670b632ee29e8bd1c0c59fcc27285ff2736e6d098

Analysis

max time kernel
175s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 12:36

Target

Americanas -NFE -360632844-201501002.dll
Size

517KB
MD5

533702004235cdaaddd7d239a7cfc142
SHA1

49f58d942e7ac92684d73d43f748597baebb889e
SHA256

346ed2a824e69624eeffc71da903832989fd652bb52b34940834281d643dbeb1
SHA512

085fc65e2d390cbab9bcd1b2bb63316090168fca050259119f27daa2fb4e0bef7fae75d2fdbc2f6a725cc5503963f6a7e1eccb46f7ab23872e5e7682b687a06a
SSDEEP

6144:+bQwgyRk2K2V8YFp63qsRep51fpbV300Mq1l9Y/tRahLA4SN9SoN7evtdkErwSo5:bbg4TsfxZ1lUtopA4SN9Sg7eLlRfml

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/3432-133-0x0000000000820000-0x000000000094F000-memory.dmp	vmprotect
behavioral2/memory/3432-135-0x0000000000820000-0x000000000094F000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4556 wrote to memory of 3432	4556	rundll32.exe	rundll32.exe
PID 4556 wrote to memory of 3432	4556	rundll32.exe	rundll32.exe
PID 4556 wrote to memory of 3432	4556	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Americanas -NFE -360632844-201501002.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Americanas -NFE -360632844-201501002.dll",#1
  2⤵
  PID:3432

memory/3432-132-0x0000000000000000-mapping.dmp

Download
memory/3432-133-0x0000000000820000-0x000000000094F000-memory.dmp

Filesize
1.2MB

Download
memory/3432-135-0x0000000000820000-0x000000000094F000-memory.dmp

Filesize
1.2MB

Download