5beb4b52f81c9604dd4c173fe0a98dfb34e56df6705ffa474f1938f9f7b375f6

Analysis

max time kernel
32s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 23:35

Target

5beb4b52f81c9604dd4c173fe0a98dfb34e56df6705ffa474f1938f9f7b375f6.dll
Size

164KB
MD5

11366a999874e916a5996be9032e96dc
SHA1

d9a7f4af0af09779a4b1e399b115d241c5406965
SHA256

5beb4b52f81c9604dd4c173fe0a98dfb34e56df6705ffa474f1938f9f7b375f6
SHA512

bb230103c416cc6d216da12ba549a009ec353e08fefcb260ad05f7331ea65f9afeadb60f979546a218769fc870b3d66a78aaf7253beb2f9f31d5a79c51517b22
SSDEEP

3072:VE/4yzTx7JfB+hdiLt+D/E7EolP2a6M4MMOiPJ69KsJwp/o0:i/44B+St+jjW2E4MDARB

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1960-56-0x0000000010000000-0x0000000010069000-memory.dmp	vmprotect
behavioral1/memory/1960-59-0x0000000010000000-0x0000000010069000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 1960	868	rundll32.exe	28
PID 868 wrote to memory of 1960	868	rundll32.exe	28
PID 868 wrote to memory of 1960	868	rundll32.exe	28
PID 868 wrote to memory of 1960	868	rundll32.exe	28
PID 868 wrote to memory of 1960	868	rundll32.exe	28
PID 868 wrote to memory of 1960	868	rundll32.exe	28
PID 868 wrote to memory of 1960	868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5beb4b52f81c9604dd4c173fe0a98dfb34e56df6705ffa474f1938f9f7b375f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5beb4b52f81c9604dd4c173fe0a98dfb34e56df6705ffa474f1938f9f7b375f6.dll,#1
  2⤵
  PID:1960

memory/1960-55-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/1960-56-0x0000000010000000-0x0000000010069000-memory.dmp

Filesize
420KB

Download
memory/1960-59-0x0000000010000000-0x0000000010069000-memory.dmp

Filesize
420KB

Download