8eb732808971f76d34ab3d2df56194723e7038c82d16373eaa3993edcd3378a8

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:35

Target

8eb732808971f76d34ab3d2df56194723e7038c82d16373eaa3993edcd3378a8.dll
Size

160KB
MD5

2ad50b843ece8c1458083e0729ed47c8
SHA1

b10fefbf4ed1260ea4a684a3acb249e2e92f677e
SHA256

8eb732808971f76d34ab3d2df56194723e7038c82d16373eaa3993edcd3378a8
SHA512

efe5a990714be14508f26aa148d5db19b3e6006778f8f21879a270dd41fb889f4485d9868fd3e8a7377ab97c86538cbf1687c1cd10e83ef759ac318b94c532cb
SSDEEP

3072:NUprN62duo7eb18up2buwDAuQieWXuXIZsOPhd5nGTHta:GyR8S2P9tecdsOPhgH

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1344-56-0x0000000010000000-0x0000000010068000-memory.dmp	vmprotect
behavioral1/memory/1344-59-0x0000000010000000-0x0000000010068000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 1344	1204	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb732808971f76d34ab3d2df56194723e7038c82d16373eaa3993edcd3378a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb732808971f76d34ab3d2df56194723e7038c82d16373eaa3993edcd3378a8.dll,#1
2⤵
PID:1344

memory/1344-54-0x0000000000000000-mapping.dmp

Download
memory/1344-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1344-56-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download
memory/1344-59-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download