22c6e15b439080fe4b27a96560ad7a0cadfd6a6eb3a52dcb2f16305f8b22a7ed

Analysis

max time kernel
39s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 06:14

Target

22c6e15b439080fe4b27a96560ad7a0cadfd6a6eb3a52dcb2f16305f8b22a7ed.dll
Size

691KB
MD5

ab2bfce21c1b5b9057caf08409927b10
SHA1

f4033514b3e0f108672162bdbc0691f1e7409f32
SHA256

22c6e15b439080fe4b27a96560ad7a0cadfd6a6eb3a52dcb2f16305f8b22a7ed
SHA512

c9c775ddc0d325f1f5ea10c713b7cce0887d1a94b8aee7f0530a09ce0135d741097e9a8225fcd42469d1c3ba50937de094d304e33850fc10e73cbdbe2bd89cf3
SSDEEP

12288:vn2z1fdJPN/A7OC3ffPCLckVfjx87Kd/ILeWKRHJPoOyQ3I32vISVw4zXK7c7lbS:uz17WyCPacKfjxwKdwLINiVQ4mQSa4al

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1460-56-0x0000000010000000-0x00000000100F1000-memory.dmp	vmprotect
behavioral1/memory/1460-57-0x0000000010000000-0x00000000100F1000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22c6e15b439080fe4b27a96560ad7a0cadfd6a6eb3a52dcb2f16305f8b22a7ed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22c6e15b439080fe4b27a96560ad7a0cadfd6a6eb3a52dcb2f16305f8b22a7ed.dll,#1
  2⤵
  PID:1460

memory/1460-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1460-56-0x0000000010000000-0x00000000100F1000-memory.dmp

Filesize
964KB

Download
memory/1460-57-0x0000000010000000-0x00000000100F1000-memory.dmp

Filesize
964KB

Download