b95744c8165a45581b734de9a2c44a7552336cbcce9524102dc9e758d992451f

Analysis

max time kernel
37s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 21:00

Target

Ѱ1120˺test123456/3K.dll
Size

1.9MB
MD5

6203bca868d92aba0d0f0f2a3a960126
SHA1

19e2ecf3234cbc160ef97db1d4b9518320411d1b
SHA256

36cdb077066f8b1588c5f4f8720c5a24548a935b570b0ff5017d9b4dfacf2dfa
SHA512

52b0b15d2ee448a0fac1d59001b30d2781ea59da8d28dcb8f62091d125fdbfe8707c53ee12779fa33da851790f0c5120ca91da7c779a7d9800a773f0fe72a0cf
SSDEEP

49152:KnSnexfKCV8Q2ER86/iq842RKL6eu+PovJ:dnexfKCWQ18uR2oLxu+Po

Score

8^/10

vmprotect

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral23/memory/1612-56-0x0000000010000000-0x0000000010219000-memory.dmp	vmprotect
behavioral23/memory/1612-58-0x0000000010000000-0x0000000010219000-memory.dmp	vmprotect
behavioral23/memory/1612-59-0x0000000010000000-0x0000000010219000-memory.dmp	vmprotect
behavioral23/memory/1612-60-0x0000000010000000-0x0000000010219000-memory.dmp	vmprotect
behavioral23/memory/1612-61-0x0000000010000000-0x0000000010219000-memory.dmp	vmprotect
behavioral23/memory/1612-63-0x0000000010000000-0x0000000010219000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
540	1612	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1612	rundll32.exe
1612	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	rundll32.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1552 wrote to memory of 1612	1552	rundll32.exe	26
PID 1612 wrote to memory of 540	1612	rundll32.exe	27
PID 1612 wrote to memory of 540	1612	rundll32.exe	27
PID 1612 wrote to memory of 540	1612	rundll32.exe	27
PID 1612 wrote to memory of 540	1612	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ѱ1120˺test123456\3K.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ѱ1120˺test123456\3K.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 288
    3⤵
    - Program crash
    PID:540

memory/1612-55-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1612-56-0x0000000010000000-0x0000000010219000-memory.dmp

Filesize
2.1MB

Download
memory/1612-58-0x0000000010000000-0x0000000010219000-memory.dmp

Filesize
2.1MB

Download
memory/1612-59-0x0000000010000000-0x0000000010219000-memory.dmp

Filesize
2.1MB

Download
memory/1612-60-0x0000000010000000-0x0000000010219000-memory.dmp

Filesize
2.1MB

Download
memory/1612-61-0x0000000010000000-0x0000000010219000-memory.dmp

Filesize
2.1MB

Download
memory/1612-63-0x0000000010000000-0x0000000010219000-memory.dmp

Filesize
2.1MB

Download