900c6011d53cfa2d2431b354b1d19cb2643f909de7bb15144e7ac1ad7fdd680b

Analysis

max time kernel
96s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 21:16

Target

900c6011d53cfa2d2431b354b1d19cb2643f909de7bb15144e7ac1ad7fdd680b.dll
Size

160KB
MD5

0ca267b2dd22f9f0123cb12eebad21b3
SHA1

38ae80c36717537d84aba02000540ab78e4187ff
SHA256

900c6011d53cfa2d2431b354b1d19cb2643f909de7bb15144e7ac1ad7fdd680b
SHA512

5f681fbf5699f098e35f1a6b7f5ab7b0c964c86725a5d990528af4c4a46341bcc33c8a026fd6d1a71b997933b5886b12a189b0fe8df756b96ac9a59baa0cddc9
SSDEEP

3072:oUprN62duo7eb18up2buwDAuQieWXuXIZsOPhd5nGTHta:byR8S2P9tecdsOPhgH

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4864-133-0x0000000010000000-0x0000000010068000-memory.dmp	vmprotect
behavioral2/memory/4864-136-0x0000000010000000-0x0000000010068000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 4864	3012	rundll32.exe	78
PID 3012 wrote to memory of 4864	3012	rundll32.exe	78
PID 3012 wrote to memory of 4864	3012	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\900c6011d53cfa2d2431b354b1d19cb2643f909de7bb15144e7ac1ad7fdd680b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\900c6011d53cfa2d2431b354b1d19cb2643f909de7bb15144e7ac1ad7fdd680b.dll,#1
  2⤵
  PID:4864

memory/4864-133-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download
memory/4864-136-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download