a0dcf63ff683243a2dd902ce32c6b9c607e953be27d7cdf056a1ef777015d1b8

Analysis

max time kernel
29s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 05:16

Target

急速辅助免费版1120/急速免费版1120（账号test密码123456）/game.dll
Size

829KB
MD5

bb6b8fbcbbf0ce880bfb174de7319334
SHA1

a47b2f845d39a6da602e46293ca58da7d014e988
SHA256

297aafaf69c972826912f0faccb1f4cdb0b5bf8826a937cb4ce66c71677f350a
SHA512

ed2c3f7bbf5115848367ce1a7e933f6b1dae72646829ab35ca66ccaf95d9f17696bdc099cb9ed324133083963e5d906c7fed19e5758eda0be1695d293484b775
SSDEEP

12288:ifwaCksSKrsWn5TmE/a1O0G7Lg6iFvZZLw9LaCXKEiaBfaBp2m4/hxzEo4nlC4zV:qXs1nME/a1mLsFvPw9+Moj4PEjl7zO8

Score

8^/10

vmprotect

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral27/memory/1992-56-0x0000000074AA0000-0x0000000074C48000-memory.dmp	vmprotect
behavioral27/memory/1992-58-0x0000000074AA0000-0x0000000074C48000-memory.dmp	vmprotect
behavioral27/memory/1992-60-0x0000000074AA0000-0x0000000074C48000-memory.dmp	vmprotect
behavioral27/memory/1992-61-0x0000000074AA0000-0x0000000074C48000-memory.dmp	vmprotect

Drops file in System32 directory 5 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\57DB4GlBF.systmp	rundll32.exe
File created	C:\Windows\SysWOW64\MakeAttManage.sys	rundll32.exe
File created	C:\Windows\SysWOW64\18A8LpQ6p.sys	rundll32.exe
File created	C:\Windows\SysWOW64\57DB4GlBF.sys	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\57DB4GlBF.sys	rundll32.exe

Suspicious behavior: LoadsDriver 3 IoCs

Processes:

pid process

460
460
460

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1724 wrote to memory of 1992	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1992	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1992	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1992	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1992	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1992	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1992	1724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\急速免费版1120（账号test密码123456）\game.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\急速免费版1120（账号test密码123456）\game.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:1992

memory/1992-54-0x0000000000000000-mapping.dmp

Download
memory/1992-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1992-56-0x0000000074AA0000-0x0000000074C48000-memory.dmp

Filesize
1.7MB

Download
memory/1992-58-0x0000000074AA0000-0x0000000074C48000-memory.dmp

Filesize
1.7MB

Download
memory/1992-59-0x0000000074C50000-0x0000000074DF8000-memory.dmp

Filesize
1.7MB

Download
memory/1992-60-0x0000000074AA0000-0x0000000074C48000-memory.dmp

Filesize
1.7MB

Download
memory/1992-61-0x0000000074AA0000-0x0000000074C48000-memory.dmp

Filesize
1.7MB

Download
memory/1992-62-0x0000000074C50000-0x0000000074C55000-memory.dmp

Filesize
20KB

Download