8bf236fce3668130ae61a8bf57a6af12a0af0e34140d1c50e937150e6d7d3ea0

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 05:46

Target

8bf236fce3668130ae61a8bf57a6af12a0af0e34140d1c50e937150e6d7d3ea0.dll
Size

65KB
MD5

a8a61b22f2944abd34a770295e5c393c
SHA1

3c0866bb781df041ef912edfbaa6f236724f8831
SHA256

8bf236fce3668130ae61a8bf57a6af12a0af0e34140d1c50e937150e6d7d3ea0
SHA512

28ad37a42fdd8e77cd861cdaffc19d0ee82dffe240e24db2b462cccf90f03aacc26b2aae0c712110dce6438e8db201d49a82236a59ca7ac54f471bd538c6c160
SSDEEP

1536:hVmsewAmJiC9XONYrCnEz+wjnmXNClFh4fxLBMlrtXbW5A2n:jwmJiC9+NuCnEdgQExLBMlVqRn

Score

8^/10

vmprotect

VMProtect packed file 7 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/4904-134-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect
behavioral2/memory/4904-135-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect
behavioral2/memory/4904-133-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect
behavioral2/memory/4904-136-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect
behavioral2/memory/4904-138-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect
behavioral2/memory/4904-140-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect
behavioral2/memory/4904-141-0x0000000010000000-0x0000000010021000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3264 4904 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3264	4904	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4964 wrote to memory of 4904	4964	rundll32.exe	rundll32.exe
PID 4964 wrote to memory of 4904	4964	rundll32.exe	rundll32.exe
PID 4964 wrote to memory of 4904	4964	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf236fce3668130ae61a8bf57a6af12a0af0e34140d1c50e937150e6d7d3ea0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf236fce3668130ae61a8bf57a6af12a0af0e34140d1c50e937150e6d7d3ea0.dll,#1
2⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 580
3⤵
- Program crash
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4904 -ip 4904
1⤵
PID:2168

memory/4904-132-0x0000000000000000-mapping.dmp

Download
memory/4904-134-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4904-135-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4904-133-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4904-136-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4904-138-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4904-140-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4904-141-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download