0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d

Analysis

max time kernel
14s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 00:57

Target

0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d.dll
Size

2.1MB
MD5

d7c1f86e402a9dc3fcacc2d6f021b65a
SHA1

e1acd4af9267f47bd1f3948fdb8868bcb88d763f
SHA256

0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d
SHA512

90a4690e0298396e89a3279b64acfb37fa25b3ddec6917df34eddbe915580b5df4b10bee2f630ef2815a93ce8574fcccab3b5ea7b099886a2534bdc889d356b3
SSDEEP

49152:4fN8zLIixWrAVWap+93E6cUNaKr6avchdpaRZq6Bau:4l8/jA1ap+BOUNa+6CcOqWau

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/948-56-0x0000000010000000-0x0000000010507000-memory.dmp	vmprotect
behavioral1/memory/948-60-0x0000000010000000-0x0000000010507000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
948	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 948	1264	rundll32.exe	28
PID 1264 wrote to memory of 948	1264	rundll32.exe	28
PID 1264 wrote to memory of 948	1264	rundll32.exe	28
PID 1264 wrote to memory of 948	1264	rundll32.exe	28
PID 1264 wrote to memory of 948	1264	rundll32.exe	28
PID 1264 wrote to memory of 948	1264	rundll32.exe	28
PID 1264 wrote to memory of 948	1264	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:948

memory/948-55-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/948-56-0x0000000010000000-0x0000000010507000-memory.dmp

Filesize
5.0MB

Download
memory/948-60-0x0000000010000000-0x0000000010507000-memory.dmp

Filesize
5.0MB

Download
memory/948-61-0x0000000010000000-0x0000000010507000-memory.dmp

Filesize
5.0MB

Download