842d0f3bf639b1a729c5bbe81bba30bc4fd9927432913a3fc70a71fea52c41c9

Analysis

max time kernel
100s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 06:40

Target

842d0f3bf639b1a729c5bbe81bba30bc4fd9927432913a3fc70a71fea52c41c9.dll
Size

90KB
MD5

06e23de501c9a693c15a67ba41f2c430
SHA1

8f7e42ba6fb76b716f095fdb96491c4a57971943
SHA256

842d0f3bf639b1a729c5bbe81bba30bc4fd9927432913a3fc70a71fea52c41c9
SHA512

82d6ee8c93a05b82f2e6b4fbe0885bf539c0a32802b019e40b5e0b7b15c80db3489728c723ffea9b696fdca47177d720738f7647b20992976fd57b19e60da16c
SSDEEP

1536:3RNiVU4ijXgoSFbiTl9xMDPHEAvuJpJiGAsspYlSqdEsdC/It61:BgizgmT/xMDRuJpJiG8pGFEsq1

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/5044-133-0x00000000007F0000-0x000000000080A000-memory.dmp	vmprotect
behavioral2/memory/5044-134-0x00000000007F0000-0x000000000080A000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3204 wrote to memory of 5044	3204	rundll32.exe	rundll32.exe
PID 3204 wrote to memory of 5044	3204	rundll32.exe	rundll32.exe
PID 3204 wrote to memory of 5044	3204	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\842d0f3bf639b1a729c5bbe81bba30bc4fd9927432913a3fc70a71fea52c41c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3204

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\842d0f3bf639b1a729c5bbe81bba30bc4fd9927432913a3fc70a71fea52c41c9.dll,#1
2⤵
PID:5044

memory/5044-132-0x0000000000000000-mapping.dmp

Download
memory/5044-133-0x00000000007F0000-0x000000000080A000-memory.dmp

Filesize
104KB

Download
memory/5044-134-0x00000000007F0000-0x000000000080A000-memory.dmp

Filesize
104KB

Download