0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d

Analysis

max time kernel
157s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 00:57

Target

0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d.dll
Size

2.1MB
MD5

d7c1f86e402a9dc3fcacc2d6f021b65a
SHA1

e1acd4af9267f47bd1f3948fdb8868bcb88d763f
SHA256

0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d
SHA512

90a4690e0298396e89a3279b64acfb37fa25b3ddec6917df34eddbe915580b5df4b10bee2f630ef2815a93ce8574fcccab3b5ea7b099886a2534bdc889d356b3
SSDEEP

49152:4fN8zLIixWrAVWap+93E6cUNaKr6avchdpaRZq6Bau:4l8/jA1ap+BOUNa+6CcOqWau

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3552-133-0x0000000010000000-0x0000000010507000-memory.dmp	vmprotect
behavioral2/memory/3552-134-0x0000000010000000-0x0000000010507000-memory.dmp	vmprotect
behavioral2/memory/3552-138-0x0000000010000000-0x0000000010507000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3552	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3552	4268	rundll32.exe	82
PID 4268 wrote to memory of 3552	4268	rundll32.exe	82
PID 4268 wrote to memory of 3552	4268	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e7e737b25c0586a38c8222f0cfb2b2ca9a01317dcd40dfbe34b28ec4289a37d.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3552

memory/3552-133-0x0000000010000000-0x0000000010507000-memory.dmp

Filesize
5.0MB

Download
memory/3552-134-0x0000000010000000-0x0000000010507000-memory.dmp

Filesize
5.0MB

Download
memory/3552-138-0x0000000010000000-0x0000000010507000-memory.dmp

Filesize
5.0MB

Download