0123418ffeceaec339159113651a7f2bb502b64b25a34d812b27ff88e1e53db3

Analysis

max time kernel
44s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 07:18

Target

明月11.79/TYBOX.dll
Size

913KB
MD5

5fc6f3a85c6ac96815669e4124c68085
SHA1

43487869f89df6d0a1b8dbcb7dbbc1616c766387
SHA256

573f8328caca5de40977f8b9d653010a2280d3bf7422a00cd8bd36bb0f3e2862
SHA512

74433c5323aa71b3559827d0dedf5c4feb17984df510c8888977c8b04a9c80e08b254dee8c6e063b61ab417aca449cc132663c679f63ffccbfa28a08b17f7fa9
SSDEEP

12288:o6/8XLLgKvCSJIxjYZ5sIqMrxMMWaD+OkNL0XXOYLSbllMBBuFsVAHjF1y04ONMN:ouHKvCSJxZ/1hWb/EZSb0ESW3NMN

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral9/memory/900-56-0x00000000744D0000-0x000000007469A000-memory.dmp	vmprotect
behavioral9/memory/900-60-0x00000000744D0000-0x000000007469A000-memory.dmp	vmprotect
behavioral9/memory/900-62-0x00000000744D0000-0x000000007469A000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1128 wrote to memory of 900	1128	rundll32.exe	rundll32.exe
PID 1128 wrote to memory of 900	1128	rundll32.exe	rundll32.exe
PID 1128 wrote to memory of 900	1128	rundll32.exe	rundll32.exe
PID 1128 wrote to memory of 900	1128	rundll32.exe	rundll32.exe
PID 1128 wrote to memory of 900	1128	rundll32.exe	rundll32.exe
PID 1128 wrote to memory of 900	1128	rundll32.exe	rundll32.exe
PID 1128 wrote to memory of 900	1128	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\TYBOX.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\明月11.79\TYBOX.dll,#1
  2⤵
  PID:900

memory/900-54-0x0000000000000000-mapping.dmp

Download
memory/900-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/900-56-0x00000000744D0000-0x000000007469A000-memory.dmp

Filesize
1.8MB

Download
memory/900-59-0x00000000746A0000-0x000000007486A000-memory.dmp

Filesize
1.8MB

Download
memory/900-60-0x00000000744D0000-0x000000007469A000-memory.dmp

Filesize
1.8MB

Download
memory/900-61-0x00000000746A0000-0x000000007486A000-memory.dmp

Filesize
1.8MB

Download
memory/900-62-0x00000000744D0000-0x000000007469A000-memory.dmp

Filesize
1.8MB

Download