21b7cd961632a727c2adaba0a06b357fa041f23d2b91c549918de2d99fa5c611

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 20:40

Target

21b7cd961632a727c2adaba0a06b357fa041f23d2b91c549918de2d99fa5c611.dll
Size

1.9MB
MD5

923997a13c3aa77f8963853fb42e1e3b
SHA1

0cf8e502cb79b61adc9ba066864d086716772df2
SHA256

21b7cd961632a727c2adaba0a06b357fa041f23d2b91c549918de2d99fa5c611
SHA512

bbba8f8534e1e622e823e3490616d1b949a20acf65841fd09337dd8b9b85c9f2383126eb9bd10c2bb72357f9e086be657c4bef4c58098865a078d52f487fb8e1
SSDEEP

49152:bHUKIdZ3Xv/fi6py/PAfzHZbL09AuoCNEDP4GauEvPn:lIP/vpSqdL0KRYcP4OUn

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/668-56-0x0000000010000000-0x000000001049B000-memory.dmp	vmprotect
behavioral1/memory/668-60-0x0000000010000000-0x000000001049B000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

668 rundll32.exe

pid	process
668	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1952 wrote to memory of 668	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 668	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 668	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 668	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 668	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 668	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 668	1952	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21b7cd961632a727c2adaba0a06b357fa041f23d2b91c549918de2d99fa5c611.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21b7cd961632a727c2adaba0a06b357fa041f23d2b91c549918de2d99fa5c611.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:668

memory/668-54-0x0000000000000000-mapping.dmp

Download
memory/668-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/668-56-0x0000000010000000-0x000000001049B000-memory.dmp

Filesize
4.6MB

Download
memory/668-60-0x0000000010000000-0x000000001049B000-memory.dmp

Filesize
4.6MB

Download