8cf640ab8fcac90766716494f858547aeeb43efb100fcb2cd165dd30370ccaec

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:42

Target

8cf640ab8fcac90766716494f858547aeeb43efb100fcb2cd165dd30370ccaec.dll
Size

152KB
MD5

1542892f83c5767339235bba6e44c410
SHA1

b27594c3e538454b9fb6fb28a68f89e94c00e6f4
SHA256

8cf640ab8fcac90766716494f858547aeeb43efb100fcb2cd165dd30370ccaec
SHA512

3abb27f32db86d60040868e135b2df7a2daee8ddeebdb75a6c64cd5fcb5dc670eb04e1838b2dd7e654bf4ef908d93a323d6d4acac08521c343306c8f82a16b18
SSDEEP

3072:Pb8m+CtsQMuSfwKKgd/yKG8T5CHx0aLU3ELPm5jbPWg1vZ1ZYey+71ykY6zOzi:I3CEfwK68lCHBe1ug1vZ13Eaazi

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/780-56-0x0000000010000000-0x0000000010067000-memory.dmp	vmprotect
behavioral1/memory/780-59-0x0000000010000000-0x0000000010067000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1652 wrote to memory of 780	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 780	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 780	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 780	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 780	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 780	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 780	1652	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8cf640ab8fcac90766716494f858547aeeb43efb100fcb2cd165dd30370ccaec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8cf640ab8fcac90766716494f858547aeeb43efb100fcb2cd165dd30370ccaec.dll,#1
2⤵
PID:780

memory/780-54-0x0000000000000000-mapping.dmp

Download
memory/780-55-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/780-56-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download
memory/780-59-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download