c3cc791162217675482ff43e63bdced052f523e7c3d035cc3b6dcd7984a98976

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 14:39

Target

c3cc791162217675482ff43e63bdced052f523e7c3d035cc3b6dcd7984a98976.dll
Size

220KB
MD5

df0356d8758a420283ed285040c2ed37
SHA1

476f12c1ed91a7c3d67e132b77dcfb530533f56c
SHA256

c3cc791162217675482ff43e63bdced052f523e7c3d035cc3b6dcd7984a98976
SHA512

2fdf9380ad2509f5b0d2b1a932552459974a91cc4c5ed864a7db995ca418273637c426254ccd43d441a60b62fefd7e991ebe38e00978a1d9bee64f76af3da206
SSDEEP

6144:sZVxRCUCU0oetYjVV27mZOHePuT6E3we7JHUQINF:WrCVNYjVV27RQuT6E31a

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1480-56-0x0000000010000000-0x000000001007E000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3cc791162217675482ff43e63bdced052f523e7c3d035cc3b6dcd7984a98976.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3cc791162217675482ff43e63bdced052f523e7c3d035cc3b6dcd7984a98976.dll,#1
  2⤵
  PID:1480

memory/1480-54-0x0000000000000000-mapping.dmp

Download
memory/1480-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1480-56-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download