8e443efd4f3f6dfce2f288b63a389189de77e8c228c6557d404107c883e1ac0b

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 00:59

Target

8e443efd4f3f6dfce2f288b63a389189de77e8c228c6557d404107c883e1ac0b.dll
Size

156KB
MD5

80af0377178b7cd1868cf6d0ddfbd9bd
SHA1

6d5581763fd711396532a58ec218ee1389d776f2
SHA256

8e443efd4f3f6dfce2f288b63a389189de77e8c228c6557d404107c883e1ac0b
SHA512

f99ce054a30da440a7bdb726dcdbb5cfa5ef78b16f5f203dd094cb48f12a3a4a160532ddbc00a08d5fcf06596ad9899634a23ac3eace5d91ba88a15abe393b72
SSDEEP

3072:ugaZydhMp4/MUCOHu6Au+cb7mcJc0vE152YDjHlphfvs4SmNBO/jFiz:ugaQdhAH6AuLa+XSjHN8oPKw

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/748-133-0x0000000010000000-0x0000000010067000-memory.dmp	vmprotect
behavioral2/memory/748-136-0x0000000010000000-0x0000000010067000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 748	3676	rundll32.exe	82
PID 3676 wrote to memory of 748	3676	rundll32.exe	82
PID 3676 wrote to memory of 748	3676	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e443efd4f3f6dfce2f288b63a389189de77e8c228c6557d404107c883e1ac0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e443efd4f3f6dfce2f288b63a389189de77e8c228c6557d404107c883e1ac0b.dll,#1
  2⤵
  PID:748

memory/748-133-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download
memory/748-136-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download