a0dcf63ff683243a2dd902ce32c6b9c607e953be27d7cdf056a1ef777015d1b8

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 05:16

Target

急速辅助免费版1120/急速免费版1120（账号test密码123456）/game.dll
Size

829KB
MD5

bb6b8fbcbbf0ce880bfb174de7319334
SHA1

a47b2f845d39a6da602e46293ca58da7d014e988
SHA256

297aafaf69c972826912f0faccb1f4cdb0b5bf8826a937cb4ce66c71677f350a
SHA512

ed2c3f7bbf5115848367ce1a7e933f6b1dae72646829ab35ca66ccaf95d9f17696bdc099cb9ed324133083963e5d906c7fed19e5758eda0be1695d293484b775
SSDEEP

12288:ifwaCksSKrsWn5TmE/a1O0G7Lg6iFvZZLw9LaCXKEiaBfaBp2m4/hxzEo4nlC4zV:qXs1nME/a1mLsFvPw9+Moj4PEjl7zO8

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral28/memory/4952-133-0x0000000074BA0000-0x0000000074D48000-memory.dmp	vmprotect
behavioral28/memory/4952-135-0x0000000074BA0000-0x0000000074D48000-memory.dmp	vmprotect

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\A7715568Z.sys rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\A7715568Z.sys	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2608 wrote to memory of 4952	2608	rundll32.exe	rundll32.exe
PID 2608 wrote to memory of 4952	2608	rundll32.exe	rundll32.exe
PID 2608 wrote to memory of 4952	2608	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\急速免费版1120（账号test密码123456）\game.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\急速免费版1120（账号test密码123456）\game.dll,#1
2⤵
- Drops file in System32 directory
PID:4952

memory/4952-132-0x0000000000000000-mapping.dmp

Download
memory/4952-133-0x0000000074BA0000-0x0000000074D48000-memory.dmp

Filesize
1.7MB

Download
memory/4952-135-0x0000000074BA0000-0x0000000074D48000-memory.dmp

Filesize
1.7MB

Download