8bf236fce3668130ae61a8bf57a6af12a0af0e34140d1c50e937150e6d7d3ea0

Analysis

max time kernel
21s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:46

Target

8bf236fce3668130ae61a8bf57a6af12a0af0e34140d1c50e937150e6d7d3ea0.dll
Size

65KB
MD5

a8a61b22f2944abd34a770295e5c393c
SHA1

3c0866bb781df041ef912edfbaa6f236724f8831
SHA256

8bf236fce3668130ae61a8bf57a6af12a0af0e34140d1c50e937150e6d7d3ea0
SHA512

28ad37a42fdd8e77cd861cdaffc19d0ee82dffe240e24db2b462cccf90f03aacc26b2aae0c712110dce6438e8db201d49a82236a59ca7ac54f471bd538c6c160
SSDEEP

1536:hVmsewAmJiC9XONYrCnEz+wjnmXNClFh4fxLBMlrtXbW5A2n:jwmJiC9+NuCnEdgQExLBMlVqRn

Score

8^/10

vmprotect

VMProtect packed file 7 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1640-57-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect
behavioral1/memory/1640-58-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect
behavioral1/memory/1640-56-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect
behavioral1/memory/1640-60-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect
behavioral1/memory/1640-59-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect
behavioral1/memory/1640-61-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect
behavioral1/memory/1640-62-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 960 wrote to memory of 1640	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1640	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1640	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1640	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1640	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1640	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1640	960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf236fce3668130ae61a8bf57a6af12a0af0e34140d1c50e937150e6d7d3ea0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf236fce3668130ae61a8bf57a6af12a0af0e34140d1c50e937150e6d7d3ea0.dll,#1
2⤵
PID:1640

memory/1640-54-0x0000000000000000-mapping.dmp

Download
memory/1640-55-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1640-57-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1640-58-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1640-56-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1640-60-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1640-59-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1640-61-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1640-62-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download