0123418ffeceaec339159113651a7f2bb502b64b25a34d812b27ff88e1e53db3

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 07:18

Target

明月11.79/box.dll
Size

2.7MB
MD5

d40c606ef8cd891352a863b612ef317c
SHA1

815fa415695b203970012a719ced8c7bcd9b2824
SHA256

93b0796a736ea8d4bc9723eb55ce64e49605c55332494498a4cb24828f74e631
SHA512

1e678e1e5ac2e802c1122c7a46dc3d8295d224cae737f56ab8bd956815f3bcb0e0a0f2f9fe757c3444da91911fb5f603ae5ddb8b741494bd8cd0315f0ddd1ab1
SSDEEP

49152:I3+/qXwkZaKnieQvldCcAytk9CJis3/r/pU4u4oMsFB3aZ6OvmiixHXnSu:I3FLIKidjAl9ab1u5M+wvu1

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral13/memory/1392-57-0x0000000073F80000-0x00000000744FE000-memory.dmp	vmprotect
behavioral13/memory/1392-59-0x0000000073F80000-0x00000000744FE000-memory.dmp	vmprotect
behavioral13/memory/1392-60-0x0000000073F80000-0x00000000744FE000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1996 wrote to memory of 1392	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1392	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1392	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1392	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1392	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1392	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1392	1996	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\box.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\box.dll,#1
  2⤵
  PID:1392

memory/1392-54-0x0000000000000000-mapping.dmp

Download
memory/1392-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1392-56-0x0000000074500000-0x0000000074A7E000-memory.dmp

Filesize
5.5MB

Download
memory/1392-57-0x0000000073F80000-0x00000000744FE000-memory.dmp

Filesize
5.5MB

Download
memory/1392-58-0x0000000074500000-0x0000000074A7E000-memory.dmp

Filesize
5.5MB

Download
memory/1392-59-0x0000000073F80000-0x00000000744FE000-memory.dmp

Filesize
5.5MB

Download
memory/1392-60-0x0000000073F80000-0x00000000744FE000-memory.dmp

Filesize
5.5MB

Download