b60231e4a761fee0a5d9456062589b14a1562ea9524d95d694ac461f608a4731

Analysis

max time kernel
201s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 14:45

Target

b60231e4a761fee0a5d9456062589b14a1562ea9524d95d694ac461f608a4731.dll
Size

152KB
MD5

3da2bd68c3ba18dee3ef6b4b8c09b049
SHA1

6e525b591cb1fad9e9ae374c7ddcf61ead575636
SHA256

b60231e4a761fee0a5d9456062589b14a1562ea9524d95d694ac461f608a4731
SHA512

1b6852f8c9288c7cd4b618d15d5c4a0ec9e8f06dad0a1d5b68460c974516ae49297bef9714b4ffe188b022165a7da490f6ab53bfee34cc0c3e69199f142f6b6d
SSDEEP

3072:t8m+CtsQMuSfwKKgd/yKG8T5CHx0aLU3ELPm5jbPWg1vZ1ZYey+71ykY6zOzi:i3CEfwK68lCHBe1ug1vZ13Eaazi

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3368-133-0x0000000010000000-0x0000000010067000-memory.dmp	vmprotect
behavioral2/memory/3368-136-0x0000000010000000-0x0000000010067000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 3368	2456	rundll32.exe	82
PID 2456 wrote to memory of 3368	2456	rundll32.exe	82
PID 2456 wrote to memory of 3368	2456	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b60231e4a761fee0a5d9456062589b14a1562ea9524d95d694ac461f608a4731.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b60231e4a761fee0a5d9456062589b14a1562ea9524d95d694ac461f608a4731.dll,#1
  2⤵
  PID:3368

memory/3368-133-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download
memory/3368-136-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download