cd7456aa12b571dc9b435f57551d0c9ae09dba25f459f63bb9263cf0a7144206

Analysis

max time kernel
57s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 17:25

Target

Comentario Facebook.dll
Size

818KB
MD5

d1e653008ecf8acc0823c78a44fbdfbf
SHA1

b698b5aa781f424371553db3573fe1c6a2a7c925
SHA256

32e90fa946e5592afb42b60910253a669410185fcc4c9a1bd5c5eaa3f923eaa2
SHA512

af282a2a540fb7dede680f3adb6bd272530f092b26f79b28f52bb9fa708cc3c719fe43cd0a29f67675b9bc2fef2c06063f4cce357a4242f2bd0a1ba199875ac7
SSDEEP

12288:0aF+frgs7Y2tP9uV+q8jSW3ldcBcwQiaolrvlb1FLx4cw5fSi/kLDp6xs8:n656+R/1S8i1lrvlrN4rSi/qDp6L

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2000-57-0x0000000000990000-0x0000000000B61000-memory.dmp	vmprotect
behavioral1/memory/2000-58-0x0000000000990000-0x0000000000B61000-memory.dmp	vmprotect
behavioral1/memory/2000-56-0x0000000000990000-0x0000000000B61000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 2000	1992	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Comentario Facebook.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Comentario Facebook.dll",#1
2⤵
PID:2000

memory/2000-54-0x0000000000000000-mapping.dmp

Download
memory/2000-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/2000-57-0x0000000000990000-0x0000000000B61000-memory.dmp

Filesize
1.8MB

Download
memory/2000-58-0x0000000000990000-0x0000000000B61000-memory.dmp

Filesize
1.8MB

Download
memory/2000-56-0x0000000000990000-0x0000000000B61000-memory.dmp

Filesize
1.8MB

Download