61bcb50be5a258a52ab7c7ad980edfc8ef7351a6d51aee25b9d1d5c00af82f3b

Analysis

max time kernel
20s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 08:34

Target

61bcb50be5a258a52ab7c7ad980edfc8ef7351a6d51aee25b9d1d5c00af82f3b.dll
Size

148KB
MD5

d90dfb09c0fde19b40e7de6a82daa206
SHA1

3d38439d0439429f9ad3fef1dd083fe5deddb41e
SHA256

61bcb50be5a258a52ab7c7ad980edfc8ef7351a6d51aee25b9d1d5c00af82f3b
SHA512

2abfa74b3e1b493467111a5409b8d9e5ead8fbb1f9a2b3b099598e7a826da14069b8cca7795892c5f9c619500ba2815639d0df257dc35ec5ec9282611ee11ef8
SSDEEP

3072:tsgUEK16+5paulTax/lOebrTYn6uWvKfZIoH+QjSGSSBJMROx:EX1XIKMtNbrTYn6uW+PHXjgsqI

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/972-56-0x0000000010000000-0x000000001005A000-memory.dmp	vmprotect
behavioral1/memory/972-59-0x0000000010000000-0x000000001005A000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 972	1952	rundll32.exe	28
PID 1952 wrote to memory of 972	1952	rundll32.exe	28
PID 1952 wrote to memory of 972	1952	rundll32.exe	28
PID 1952 wrote to memory of 972	1952	rundll32.exe	28
PID 1952 wrote to memory of 972	1952	rundll32.exe	28
PID 1952 wrote to memory of 972	1952	rundll32.exe	28
PID 1952 wrote to memory of 972	1952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61bcb50be5a258a52ab7c7ad980edfc8ef7351a6d51aee25b9d1d5c00af82f3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61bcb50be5a258a52ab7c7ad980edfc8ef7351a6d51aee25b9d1d5c00af82f3b.dll,#1
  2⤵
  PID:972

memory/972-54-0x0000000000000000-mapping.dmp

Download
memory/972-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/972-56-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/972-59-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download