73a85512a5f5f4bbbc7ac3e19915f9580e3d54b733cc68addf2375c973c6e503

Analysis

max time kernel
169s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 21:05

Target

73a85512a5f5f4bbbc7ac3e19915f9580e3d54b733cc68addf2375c973c6e503.dll
Size

509KB
MD5

5c1dec1a74d1aefc398106629c9e12a7
SHA1

a07667dabe1dcff4c6b9f4aad3799b2101310067
SHA256

73a85512a5f5f4bbbc7ac3e19915f9580e3d54b733cc68addf2375c973c6e503
SHA512

8ca064e20498ead2cb8ac91c253c5c3d3de545396d795080270748850b5994c3edaad4645ab80a98fe3f96325f493dd1a47fdbd194b11c36e57dcbf1ef840526
SSDEEP

12288:/bYWEtwL25NYe3dCFTkJT/ln1xf4Fq/AFa30wsM2:/AjSe4FWl1CFnaEc2

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/4456-133-0x0000000000BB0000-0x0000000000CDD000-memory.dmp	vmprotect
behavioral2/memory/4456-135-0x0000000000BB0000-0x0000000000CDD000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4892 wrote to memory of 4456	4892	rundll32.exe	rundll32.exe
PID 4892 wrote to memory of 4456	4892	rundll32.exe	rundll32.exe
PID 4892 wrote to memory of 4456	4892	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73a85512a5f5f4bbbc7ac3e19915f9580e3d54b733cc68addf2375c973c6e503.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73a85512a5f5f4bbbc7ac3e19915f9580e3d54b733cc68addf2375c973c6e503.dll,#1
2⤵
PID:4456

memory/4456-132-0x0000000000000000-mapping.dmp

Download
memory/4456-133-0x0000000000BB0000-0x0000000000CDD000-memory.dmp

Filesize
1.2MB

Download
memory/4456-135-0x0000000000BB0000-0x0000000000CDD000-memory.dmp

Filesize
1.2MB

Download