df509e01d305984ae308fe0bf573b001d8839d3695a17ba76fa4080804c57c4e

Analysis

max time kernel
70s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 21:05

Target

Americanas -NFE -753400096-201401002.dll
Size

509KB
MD5

5c1dec1a74d1aefc398106629c9e12a7
SHA1

a07667dabe1dcff4c6b9f4aad3799b2101310067
SHA256

73a85512a5f5f4bbbc7ac3e19915f9580e3d54b733cc68addf2375c973c6e503
SHA512

8ca064e20498ead2cb8ac91c253c5c3d3de545396d795080270748850b5994c3edaad4645ab80a98fe3f96325f493dd1a47fdbd194b11c36e57dcbf1ef840526
SSDEEP

12288:/bYWEtwL25NYe3dCFTkJT/ln1xf4Fq/AFa30wsM2:/AjSe4FWl1CFnaEc2

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/3272-133-0x0000000000400000-0x000000000052D000-memory.dmp	vmprotect
behavioral2/memory/3272-135-0x0000000000400000-0x000000000052D000-memory.dmp	vmprotect
behavioral2/memory/3272-136-0x0000000000400000-0x000000000052D000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3036 wrote to memory of 3272	3036	rundll32.exe	rundll32.exe
PID 3036 wrote to memory of 3272	3036	rundll32.exe	rundll32.exe
PID 3036 wrote to memory of 3272	3036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Americanas -NFE -753400096-201401002.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Americanas -NFE -753400096-201401002.dll",#1
  2⤵
  PID:3272

memory/3272-132-0x0000000000000000-mapping.dmp

Download
memory/3272-133-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/3272-135-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/3272-136-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download