a6e50222012a8f9a05912ea58b59551537628f4fc34ce74a81942268cc00cbfa

Analysis

max time kernel
37s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 15:58

Target

a6e50222012a8f9a05912ea58b59551537628f4fc34ce74a81942268cc00cbfa.dll
Size

438KB
MD5

3a4d20f3903b733bbfe4fbc3e47dd6e0
SHA1

b0d94467c95e66c7d751ec01f23c238a800f5523
SHA256

a6e50222012a8f9a05912ea58b59551537628f4fc34ce74a81942268cc00cbfa
SHA512

b1dc1539be3bf89f21f8a32eac58e2a3bde858f95aa87d8f21c98ba1126a09133d112b0d75993c8c117c43a5a2fe106bd6a371c4f686a31b7c7242994fd0a234
SSDEEP

12288:3zuNWxUw2fesyaTDP2nA61WzuaWmtPnZoZ:jxj3slbF61WpWmtPZU

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1548-56-0x00000000744A0000-0x00000000745F0000-memory.dmp	vmprotect
behavioral1/memory/1548-61-0x00000000744A0000-0x00000000745F0000-memory.dmp	vmprotect
behavioral1/memory/1548-65-0x00000000744A0000-0x00000000745F0000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1548	1228	rundll32.exe	27
PID 1228 wrote to memory of 1548	1228	rundll32.exe	27
PID 1228 wrote to memory of 1548	1228	rundll32.exe	27
PID 1228 wrote to memory of 1548	1228	rundll32.exe	27
PID 1228 wrote to memory of 1548	1228	rundll32.exe	27
PID 1228 wrote to memory of 1548	1228	rundll32.exe	27
PID 1228 wrote to memory of 1548	1228	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6e50222012a8f9a05912ea58b59551537628f4fc34ce74a81942268cc00cbfa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6e50222012a8f9a05912ea58b59551537628f4fc34ce74a81942268cc00cbfa.dll,#1
  2⤵
  PID:1548

memory/1548-55-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download
memory/1548-56-0x00000000744A0000-0x00000000745F0000-memory.dmp

Filesize
1.3MB

Download
memory/1548-61-0x00000000744A0000-0x00000000745F0000-memory.dmp

Filesize
1.3MB

Download
memory/1548-60-0x00000000361A0000-0x00000000361B0000-memory.dmp

Filesize
64KB

Download
memory/1548-63-0x00000000745F0000-0x0000000074740000-memory.dmp

Filesize
1.3MB

Download
memory/1548-62-0x00000000361A0000-0x00000000361B0000-memory.dmp

Filesize
64KB

Download
memory/1548-65-0x00000000744A0000-0x00000000745F0000-memory.dmp

Filesize
1.3MB

Download
memory/1548-67-0x00000000361A0000-0x00000000361B0000-memory.dmp

Filesize
64KB

Download
memory/1548-66-0x00000000361A0000-0x00000000361B0000-memory.dmp

Filesize
64KB

Download
memory/1548-64-0x00000000361A0000-0x00000000361B0000-memory.dmp

Filesize
64KB

Download
memory/1548-68-0x00000000361A0000-0x00000000361B0000-memory.dmp

Filesize
64KB

Download
memory/1548-69-0x00000000361A0000-0x00000000361B0000-memory.dmp

Filesize
64KB

Download
memory/1548-70-0x00000000361A0000-0x00000000361B0000-memory.dmp

Filesize
64KB

Download