22c6e15b439080fe4b27a96560ad7a0cadfd6a6eb3a52dcb2f16305f8b22a7ed

Analysis

max time kernel
98s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 06:14

Target

22c6e15b439080fe4b27a96560ad7a0cadfd6a6eb3a52dcb2f16305f8b22a7ed.dll
Size

691KB
MD5

ab2bfce21c1b5b9057caf08409927b10
SHA1

f4033514b3e0f108672162bdbc0691f1e7409f32
SHA256

22c6e15b439080fe4b27a96560ad7a0cadfd6a6eb3a52dcb2f16305f8b22a7ed
SHA512

c9c775ddc0d325f1f5ea10c713b7cce0887d1a94b8aee7f0530a09ce0135d741097e9a8225fcd42469d1c3ba50937de094d304e33850fc10e73cbdbe2bd89cf3
SSDEEP

12288:vn2z1fdJPN/A7OC3ffPCLckVfjx87Kd/ILeWKRHJPoOyQ3I32vISVw4zXK7c7lbS:uz17WyCPacKfjxwKdwLINiVQ4mQSa4al

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1708-134-0x0000000010000000-0x00000000100F1000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1708	1420	rundll32.exe	79
PID 1420 wrote to memory of 1708	1420	rundll32.exe	79
PID 1420 wrote to memory of 1708	1420	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22c6e15b439080fe4b27a96560ad7a0cadfd6a6eb3a52dcb2f16305f8b22a7ed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22c6e15b439080fe4b27a96560ad7a0cadfd6a6eb3a52dcb2f16305f8b22a7ed.dll,#1
  2⤵
  PID:1708

memory/1708-134-0x0000000010000000-0x00000000100F1000-memory.dmp

Filesize
964KB

Download