900c6011d53cfa2d2431b354b1d19cb2643f909de7bb15144e7ac1ad7fdd680b

Analysis

max time kernel
59s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 21:16

Target

900c6011d53cfa2d2431b354b1d19cb2643f909de7bb15144e7ac1ad7fdd680b.dll
Size

160KB
MD5

0ca267b2dd22f9f0123cb12eebad21b3
SHA1

38ae80c36717537d84aba02000540ab78e4187ff
SHA256

900c6011d53cfa2d2431b354b1d19cb2643f909de7bb15144e7ac1ad7fdd680b
SHA512

5f681fbf5699f098e35f1a6b7f5ab7b0c964c86725a5d990528af4c4a46341bcc33c8a026fd6d1a71b997933b5886b12a189b0fe8df756b96ac9a59baa0cddc9
SSDEEP

3072:oUprN62duo7eb18up2buwDAuQieWXuXIZsOPhd5nGTHta:byR8S2P9tecdsOPhgH

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1480-56-0x0000000010000000-0x0000000010068000-memory.dmp	vmprotect
behavioral1/memory/1480-59-0x0000000010000000-0x0000000010068000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1480	1108	rundll32.exe	28
PID 1108 wrote to memory of 1480	1108	rundll32.exe	28
PID 1108 wrote to memory of 1480	1108	rundll32.exe	28
PID 1108 wrote to memory of 1480	1108	rundll32.exe	28
PID 1108 wrote to memory of 1480	1108	rundll32.exe	28
PID 1108 wrote to memory of 1480	1108	rundll32.exe	28
PID 1108 wrote to memory of 1480	1108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\900c6011d53cfa2d2431b354b1d19cb2643f909de7bb15144e7ac1ad7fdd680b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\900c6011d53cfa2d2431b354b1d19cb2643f909de7bb15144e7ac1ad7fdd680b.dll,#1
  2⤵
  PID:1480

memory/1480-55-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download
memory/1480-56-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download
memory/1480-59-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download