a0dcf63ff683243a2dd902ce32c6b9c607e953be27d7cdf056a1ef777015d1b8

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 05:16

Target

急速辅助免费版1120/急速免费版1120（账号test密码123456）/SKY.dll
Size

2.8MB
MD5

cc13fc01be4af136e42c2296fb0801ac
SHA1

10682bca093fa2e32f9873902ebce2518264f86d
SHA256

eabda8bacc9772ef8d528a47fe9d9dcbb589b9a7db410972c3e332346434e7ef
SHA512

e42d4f81cdcf9cda52831a8cc59513d6513ecc9454c985280c6003ca4d05af200ab3e56c3273d91f0a85a5fca201fae33c756e344693a0c32f86e845a2ef40fd
SSDEEP

49152:UHslDt2okV9wob/fsuY3IOY4Swtus8nBXPVmVP+E0:nJ2okV9wob7Br7s6d

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral25/memory/944-56-0x0000000010000000-0x0000000010309000-memory.dmp	vmprotect
behavioral25/memory/944-57-0x0000000010000000-0x0000000010309000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

944 rundll32.exe
944 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 944 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

944 rundll32.exe

pid	process
944	rundll32.exe
944	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	944	rundll32.exe

pid	process
944	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 948 wrote to memory of 944	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 944	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 944	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 944	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 944	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 944	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 944	948	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\急速免费版1120（账号test密码123456）\SKY.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948

memory/944-54-0x0000000000000000-mapping.dmp

Download
memory/944-55-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download
memory/944-56-0x0000000010000000-0x0000000010309000-memory.dmp

Filesize
3.0MB

Download
memory/944-57-0x0000000010000000-0x0000000010309000-memory.dmp

Filesize
3.0MB

Download