b95744c8165a45581b734de9a2c44a7552336cbcce9524102dc9e758d992451f

Analysis

max time kernel
34s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 21:00

Target

Ѱ1120˺test123456/game.dll
Size

829KB
MD5

bb6b8fbcbbf0ce880bfb174de7319334
SHA1

a47b2f845d39a6da602e46293ca58da7d014e988
SHA256

297aafaf69c972826912f0faccb1f4cdb0b5bf8826a937cb4ce66c71677f350a
SHA512

ed2c3f7bbf5115848367ce1a7e933f6b1dae72646829ab35ca66ccaf95d9f17696bdc099cb9ed324133083963e5d906c7fed19e5758eda0be1695d293484b775
SSDEEP

12288:ifwaCksSKrsWn5TmE/a1O0G7Lg6iFvZZLw9LaCXKEiaBfaBp2m4/hxzEo4nlC4zV:qXs1nME/a1mLsFvPw9+Moj4PEjl7zO8

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral27/memory/1412-57-0x0000000074B10000-0x0000000074CB8000-memory.dmp	vmprotect
behavioral27/memory/1412-59-0x0000000074B10000-0x0000000074CB8000-memory.dmp	vmprotect
behavioral27/memory/1412-60-0x0000000074B10000-0x0000000074CB8000-memory.dmp	vmprotect

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\D7C5EuupP.sys	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1412	1512	rundll32.exe	27
PID 1512 wrote to memory of 1412	1512	rundll32.exe	27
PID 1512 wrote to memory of 1412	1512	rundll32.exe	27
PID 1512 wrote to memory of 1412	1512	rundll32.exe	27
PID 1512 wrote to memory of 1412	1512	rundll32.exe	27
PID 1512 wrote to memory of 1412	1512	rundll32.exe	27
PID 1512 wrote to memory of 1412	1512	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ѱ1120˺test123456\game.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ѱ1120˺test123456\game.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:1412

memory/1412-55-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1412-56-0x0000000074CC0000-0x0000000074E68000-memory.dmp

Filesize
1.7MB

Download
memory/1412-57-0x0000000074B10000-0x0000000074CB8000-memory.dmp

Filesize
1.7MB

Download
memory/1412-58-0x0000000074CC0000-0x0000000074E68000-memory.dmp

Filesize
1.7MB

Download
memory/1412-59-0x0000000074B10000-0x0000000074CB8000-memory.dmp

Filesize
1.7MB

Download
memory/1412-60-0x0000000074B10000-0x0000000074CB8000-memory.dmp

Filesize
1.7MB

Download