847663b6dc97aba79d0f3395bc52006a0165753daa90f9b7cedc249301116616

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 06:39

Target

847663b6dc97aba79d0f3395bc52006a0165753daa90f9b7cedc249301116616.dll
Size

156KB
MD5

6f7a789ec351559ad14dc42ffb8e920f
SHA1

9b94dc3250ea1427603bf8373e40235003df7fce
SHA256

847663b6dc97aba79d0f3395bc52006a0165753daa90f9b7cedc249301116616
SHA512

e5339dcfe7fa8785b61fbef7e7bb33293266d7c73db408f95becc12cf642fc5b0949333da8b36225768c17c43d9b8066f0d469c97654831b2ea046a04a9380bb
SSDEEP

3072:lgaZydhMp4/MUCOHu6Au+cb7mcJc0vE152YDjHlphfvs4SmNBO/jFiz:lgaQdhAH6AuLa+XSjHN8oPKw

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/3692-133-0x0000000010000000-0x0000000010067000-memory.dmp	vmprotect
behavioral2/memory/3692-136-0x0000000010000000-0x0000000010067000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 432 wrote to memory of 3692	432	rundll32.exe	rundll32.exe
PID 432 wrote to memory of 3692	432	rundll32.exe	rundll32.exe
PID 432 wrote to memory of 3692	432	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\847663b6dc97aba79d0f3395bc52006a0165753daa90f9b7cedc249301116616.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\847663b6dc97aba79d0f3395bc52006a0165753daa90f9b7cedc249301116616.dll,#1
2⤵
PID:3692

memory/3692-132-0x0000000000000000-mapping.dmp

Download
memory/3692-133-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download
memory/3692-136-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download