2a66364b40efb9347aafa5628572b767f91d5a25035d7f706ee21b3e223e591f

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 11:30

Target

2a66364b40efb9347aafa5628572b767f91d5a25035d7f706ee21b3e223e591f.dll
Size

724KB
MD5

5b68341c203d57dbac1362113b06e86d
SHA1

4bdc1ad65e29dda882b51b76ad14f7872ff258e8
SHA256

2a66364b40efb9347aafa5628572b767f91d5a25035d7f706ee21b3e223e591f
SHA512

0c636fe614cac0645181a6da463eda203565f423056984ef2ac6cc09cbbe6f2af63520e8bde9149a98fd0fc1df8c90d4623980aa758c409220bf9f4b9fb7fe63
SSDEEP

12288:Mz13OlgD8IICnF/VyrUpJ4GFhE836fpfr9lU8L2sob8HqwSRS1qs3:0BD8UyrUp+Yt36flr9WJNSn0iqs3

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1696-56-0x0000000010000000-0x00000000101D0000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

1696 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1696 rundll32.exe

pid	process
1696	rundll32.exe

pid	process
1696	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 852 wrote to memory of 1696	852	rundll32.exe	rundll32.exe
PID 852 wrote to memory of 1696	852	rundll32.exe	rundll32.exe
PID 852 wrote to memory of 1696	852	rundll32.exe	rundll32.exe
PID 852 wrote to memory of 1696	852	rundll32.exe	rundll32.exe
PID 852 wrote to memory of 1696	852	rundll32.exe	rundll32.exe
PID 852 wrote to memory of 1696	852	rundll32.exe	rundll32.exe
PID 852 wrote to memory of 1696	852	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a66364b40efb9347aafa5628572b767f91d5a25035d7f706ee21b3e223e591f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:852

memory/1696-54-0x0000000000000000-mapping.dmp

Download
memory/1696-55-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1696-56-0x0000000010000000-0x00000000101D0000-memory.dmp

Filesize
1.8MB

Download