6dbeebffd9de2d1c6c10c7d2bbc221dccf92b8ee4a203f5761d1343e34436a61

Analysis

max time kernel
27s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 09:45

Target

츨11.27ɫ/츨11.27.dll
Size

1.5MB
MD5

2e5ff9dc7ea781a0d99895d318af3cef
SHA1

c2dddda1b2141a8d8fe2bd4619caffa4056e0737
SHA256

6d884320514ec3a9dbb66914eebbe03e66dd3623f124988d350dc6322b76098a
SHA512

fa0eccd58a8b7dbf8681547bc344d622391219fae1fa20eed3d7d67efa494e7f23c8670ad663ec35e4e1bb533c5ab7c784b195c5e96f7c954c45b7b2bbd50276
SSDEEP

49152:zJ58ZHuvPUbFLfdwDclKIM3IMhWaz0I0:D8ZHuvPUtQclPM3IMhWaj

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral5/memory/1716-56-0x0000000010000000-0x00000000101BF000-memory.dmp	vmprotect
behavioral5/memory/1716-57-0x0000000010000000-0x00000000101BF000-memory.dmp	vmprotect
behavioral5/memory/1716-58-0x0000000010000000-0x00000000101BF000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

1716 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1716 rundll32.exe

pid	process
1716	rundll32.exe

pid	process
1716	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1888 wrote to memory of 1716	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1716	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1716	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1716	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1716	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1716	1888	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1716	1888	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888

memory/1716-54-0x0000000000000000-mapping.dmp

Download
memory/1716-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1716-56-0x0000000010000000-0x00000000101BF000-memory.dmp

Filesize
1.7MB

Download
memory/1716-57-0x0000000010000000-0x00000000101BF000-memory.dmp

Filesize
1.7MB

Download
memory/1716-58-0x0000000010000000-0x00000000101BF000-memory.dmp

Filesize
1.7MB

Download