5cd3d90be838899acdba93aead84aca5dca9e6734cd37cbeb389a9fb9bca1a27

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 08:48

Target

5cd3d90be838899acdba93aead84aca5dca9e6734cd37cbeb389a9fb9bca1a27.dll
Size

156KB
MD5

9c4efc3bc3d690df38819b349bb89dd0
SHA1

0af6a82a04d0141296a1483173d9eae884c3a9b2
SHA256

5cd3d90be838899acdba93aead84aca5dca9e6734cd37cbeb389a9fb9bca1a27
SHA512

7e21666361db779c3e755ab2f8403783c47c97639ed85448883d318e09311e9d4da10f0c9bd930863b867a4cb73581fda952a1b941979ad170aa5db343843fc2
SSDEEP

3072:Onx9Z+bvjo5TIaGHw4kwJzpeDLzsDDGdUa02xK4epROH1D0iY9B:+b+XBwCJz0DEWUE113

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1912-56-0x0000000010000000-0x0000000010065000-memory.dmp	vmprotect
behavioral1/memory/1912-59-0x0000000010000000-0x0000000010065000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1340 wrote to memory of 1912	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1912	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1912	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1912	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1912	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1912	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1912	1340	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cd3d90be838899acdba93aead84aca5dca9e6734cd37cbeb389a9fb9bca1a27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cd3d90be838899acdba93aead84aca5dca9e6734cd37cbeb389a9fb9bca1a27.dll,#1
2⤵
PID:1912

memory/1912-54-0x0000000000000000-mapping.dmp

Download
memory/1912-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1912-56-0x0000000010000000-0x0000000010065000-memory.dmp

Filesize
404KB

Download
memory/1912-59-0x0000000010000000-0x0000000010065000-memory.dmp

Filesize
404KB

Download