a0dcf63ff683243a2dd902ce32c6b9c607e953be27d7cdf056a1ef777015d1b8

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 05:16

Target

急速辅助免费版1120/急速免费版1120（账号test密码123456）/3K.dll
Size

1.9MB
MD5

6203bca868d92aba0d0f0f2a3a960126
SHA1

19e2ecf3234cbc160ef97db1d4b9518320411d1b
SHA256

36cdb077066f8b1588c5f4f8720c5a24548a935b570b0ff5017d9b4dfacf2dfa
SHA512

52b0b15d2ee448a0fac1d59001b30d2781ea59da8d28dcb8f62091d125fdbfe8707c53ee12779fa33da851790f0c5120ca91da7c779a7d9800a773f0fe72a0cf
SSDEEP

49152:KnSnexfKCV8Q2ER86/iq842RKL6eu+PovJ:dnexfKCWQ18uR2oLxu+Po

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral24/memory/4264-133-0x0000000010000000-0x0000000010219000-memory.dmp	vmprotect
behavioral24/memory/4264-135-0x0000000010000000-0x0000000010219000-memory.dmp	vmprotect
behavioral24/memory/4264-136-0x0000000010000000-0x0000000010219000-memory.dmp	vmprotect

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

4264 rundll32.exe

pid	process
4264	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4412 wrote to memory of 4264	4412	rundll32.exe	rundll32.exe
PID 4412 wrote to memory of 4264	4412	rundll32.exe	rundll32.exe
PID 4412 wrote to memory of 4264	4412	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\急速免费版1120（账号test密码123456）\3K.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\急速免费版1120（账号test密码123456）\3K.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4264

memory/4264-132-0x0000000000000000-mapping.dmp

Download
memory/4264-133-0x0000000010000000-0x0000000010219000-memory.dmp

Filesize
2.1MB

Download
memory/4264-135-0x0000000010000000-0x0000000010219000-memory.dmp

Filesize
2.1MB

Download
memory/4264-136-0x0000000010000000-0x0000000010219000-memory.dmp

Filesize
2.1MB

Download