f060517f04f69631bb1ba5dff4dcc168744bf67e34130c243af886b943dde0e5

Analysis

max time kernel
49s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:31

Target

f060517f04f69631bb1ba5dff4dcc168744bf67e34130c243af886b943dde0e5.dll
Size

1008KB
MD5

46d5cad6051f34f86f8e7820a897e9df
SHA1

2d252fbfdc817310a49e5a804d00796bd8cbfb59
SHA256

f060517f04f69631bb1ba5dff4dcc168744bf67e34130c243af886b943dde0e5
SHA512

00f19fd4e75a1eff7077b171fcd414347afb5c5fa07a969a0a8d9a27b998aec81d20f22ce85faecc78545afbee31e47fddc8e13d71fe6043a4bbe050507043ac
SSDEEP

24576:CiD8vo480SI/ZwRbNv1bd2Au1GBeJ+B4Ay4E2iQdVVoYz55w/O:CiDavSI/Z091d2AReJ+B4H4E9QRo6w/O

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2028-56-0x0000000010000000-0x00000000102C3000-memory.dmp	vmprotect
behavioral1/memory/2028-60-0x0000000010000000-0x00000000102C3000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2028	rundll32.exe
2028	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2028	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2028	1224	rundll32.exe	28
PID 1224 wrote to memory of 2028	1224	rundll32.exe	28
PID 1224 wrote to memory of 2028	1224	rundll32.exe	28
PID 1224 wrote to memory of 2028	1224	rundll32.exe	28
PID 1224 wrote to memory of 2028	1224	rundll32.exe	28
PID 1224 wrote to memory of 2028	1224	rundll32.exe	28
PID 1224 wrote to memory of 2028	1224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f060517f04f69631bb1ba5dff4dcc168744bf67e34130c243af886b943dde0e5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f060517f04f69631bb1ba5dff4dcc168744bf67e34130c243af886b943dde0e5.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2028

memory/2028-55-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/2028-56-0x0000000010000000-0x00000000102C3000-memory.dmp

Filesize
2.8MB

Download
memory/2028-60-0x0000000010000000-0x00000000102C3000-memory.dmp

Filesize
2.8MB

Download