2bc78b2cb385b002ee7cf3406e93c7ee336765022f9c3298637dc6496d8fc2fe

Analysis

max time kernel
45s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 19:17

Target

츨12.16ɫ/츨12.16.dll
Size

1.5MB
MD5

2e5ff9dc7ea781a0d99895d318af3cef
SHA1

c2dddda1b2141a8d8fe2bd4619caffa4056e0737
SHA256

6d884320514ec3a9dbb66914eebbe03e66dd3623f124988d350dc6322b76098a
SHA512

fa0eccd58a8b7dbf8681547bc344d622391219fae1fa20eed3d7d67efa494e7f23c8670ad663ec35e4e1bb533c5ab7c784b195c5e96f7c954c45b7b2bbd50276
SSDEEP

49152:zJ58ZHuvPUbFLfdwDclKIM3IMhWaz0I0:D8ZHuvPUtQclPM3IMhWaj

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral7/memory/2044-56-0x0000000010000000-0x00000000101BF000-memory.dmp	vmprotect
behavioral7/memory/2044-57-0x0000000010000000-0x00000000101BF000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

2044 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2044 rundll32.exe

pid	process
2044	rundll32.exe

pid	process
2044	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896

memory/2044-54-0x0000000000000000-mapping.dmp

Download
memory/2044-55-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/2044-56-0x0000000010000000-0x00000000101BF000-memory.dmp

Filesize
1.7MB

Download
memory/2044-57-0x0000000010000000-0x00000000101BF000-memory.dmp

Filesize
1.7MB

Download