b77c287fb55d0e112717a0616f46b454cfad47162780f59099bf78f90432deab

Analysis

max time kernel
162s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 14:38

Target

b77c287fb55d0e112717a0616f46b454cfad47162780f59099bf78f90432deab.dll
Size

156KB
MD5

5e97a05df8f6a6516485e8cc6ce58aac
SHA1

ff74679bb8f6d41d44237a704fca5e0c4d0b5b27
SHA256

b77c287fb55d0e112717a0616f46b454cfad47162780f59099bf78f90432deab
SHA512

5b491f4cbac0a4e58869ad6443418c4af70fcf04f7dde3070590d9225e36e16244cf7ad4de8d7d93a179f40523798439c406f8d9e585c26509d976d49a9b4934
SSDEEP

3072:5gaZydhMp4/MUCOHu6Au+cb7mcJc0vE152YDjHlphfvs4SmNBO/jFiz:5gaQdhAH6AuLa+XSjHN8oPKw

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4556-133-0x0000000010000000-0x0000000010067000-memory.dmp	vmprotect
behavioral2/memory/4556-136-0x0000000010000000-0x0000000010067000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4556	4136	rundll32.exe	80
PID 4136 wrote to memory of 4556	4136	rundll32.exe	80
PID 4136 wrote to memory of 4556	4136	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b77c287fb55d0e112717a0616f46b454cfad47162780f59099bf78f90432deab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b77c287fb55d0e112717a0616f46b454cfad47162780f59099bf78f90432deab.dll,#1
  2⤵
  PID:4556

memory/4556-133-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download
memory/4556-136-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download