0a8da0fc4739fda00ab19e8b0ffda310aa6a78ecdea4e30d8a99276a7338a6e7

Analysis

max time kernel
26s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 19:04

Target

0a8da0fc4739fda00ab19e8b0ffda310aa6a78ecdea4e30d8a99276a7338a6e7.dll
Size

156KB
MD5

c4f03a78c4b6809c8cc4da2b0dfa0cf0
SHA1

9e39d9437db154b86ee8a0ec788d569413a12c62
SHA256

0a8da0fc4739fda00ab19e8b0ffda310aa6a78ecdea4e30d8a99276a7338a6e7
SHA512

1b1cf4b455e47e6c0497030fbbb24afbee95c0729940a151f1c374a0157c350db40dfa44359b377664f110967cd73cfa8e9dd34635cf63a06725e677298f4e53
SSDEEP

3072:6Vi6FJwCxqRIiNuC60nQxe4SmMVv/zD43vgY47NLjEJf4YBIIS:6bFIxucnQ/S1v/zDSUNLj+fVi

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1220-56-0x0000000010000000-0x0000000010068000-memory.dmp	vmprotect
behavioral1/memory/1220-59-0x0000000010000000-0x0000000010068000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27
PID 892 wrote to memory of 1220	892	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8da0fc4739fda00ab19e8b0ffda310aa6a78ecdea4e30d8a99276a7338a6e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8da0fc4739fda00ab19e8b0ffda310aa6a78ecdea4e30d8a99276a7338a6e7.dll,#1
  2⤵
  PID:1220

memory/1220-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1220-56-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download
memory/1220-59-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download