2a66364b40efb9347aafa5628572b767f91d5a25035d7f706ee21b3e223e591f

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 11:30

Target

2a66364b40efb9347aafa5628572b767f91d5a25035d7f706ee21b3e223e591f.dll
Size

724KB
MD5

5b68341c203d57dbac1362113b06e86d
SHA1

4bdc1ad65e29dda882b51b76ad14f7872ff258e8
SHA256

2a66364b40efb9347aafa5628572b767f91d5a25035d7f706ee21b3e223e591f
SHA512

0c636fe614cac0645181a6da463eda203565f423056984ef2ac6cc09cbbe6f2af63520e8bde9149a98fd0fc1df8c90d4623980aa758c409220bf9f4b9fb7fe63
SSDEEP

12288:Mz13OlgD8IICnF/VyrUpJ4GFhE836fpfr9lU8L2sob8HqwSRS1qs3:0BD8UyrUp+Yt36flr9WJNSn0iqs3

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/5088-133-0x0000000010000000-0x00000000101D0000-memory.dmp	vmprotect
behavioral2/memory/5088-136-0x0000000010000000-0x00000000101D0000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

5088 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

5088 rundll32.exe

pid	process
5088	rundll32.exe

pid	process
5088	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5072 wrote to memory of 5088	5072	rundll32.exe	rundll32.exe
PID 5072 wrote to memory of 5088	5072	rundll32.exe	rundll32.exe
PID 5072 wrote to memory of 5088	5072	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a66364b40efb9347aafa5628572b767f91d5a25035d7f706ee21b3e223e591f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072

memory/5088-132-0x0000000000000000-mapping.dmp

Download
memory/5088-133-0x0000000010000000-0x00000000101D0000-memory.dmp

Filesize
1.8MB

Download
memory/5088-136-0x0000000010000000-0x00000000101D0000-memory.dmp

Filesize
1.8MB

Download