61bcb50be5a258a52ab7c7ad980edfc8ef7351a6d51aee25b9d1d5c00af82f3b

Analysis

max time kernel
166s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 08:34

Target

61bcb50be5a258a52ab7c7ad980edfc8ef7351a6d51aee25b9d1d5c00af82f3b.dll
Size

148KB
MD5

d90dfb09c0fde19b40e7de6a82daa206
SHA1

3d38439d0439429f9ad3fef1dd083fe5deddb41e
SHA256

61bcb50be5a258a52ab7c7ad980edfc8ef7351a6d51aee25b9d1d5c00af82f3b
SHA512

2abfa74b3e1b493467111a5409b8d9e5ead8fbb1f9a2b3b099598e7a826da14069b8cca7795892c5f9c619500ba2815639d0df257dc35ec5ec9282611ee11ef8
SSDEEP

3072:tsgUEK16+5paulTax/lOebrTYn6uWvKfZIoH+QjSGSSBJMROx:EX1XIKMtNbrTYn6uW+PHXjgsqI

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4040-133-0x0000000010000000-0x000000001005A000-memory.dmp	vmprotect
behavioral2/memory/4040-136-0x0000000010000000-0x000000001005A000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4040	4340	rundll32.exe	80
PID 4340 wrote to memory of 4040	4340	rundll32.exe	80
PID 4340 wrote to memory of 4040	4340	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61bcb50be5a258a52ab7c7ad980edfc8ef7351a6d51aee25b9d1d5c00af82f3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61bcb50be5a258a52ab7c7ad980edfc8ef7351a6d51aee25b9d1d5c00af82f3b.dll,#1
  2⤵
  PID:4040

memory/4040-133-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/4040-136-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download