a6e50222012a8f9a05912ea58b59551537628f4fc34ce74a81942268cc00cbfa

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 15:58

Target

a6e50222012a8f9a05912ea58b59551537628f4fc34ce74a81942268cc00cbfa.dll
Size

438KB
MD5

3a4d20f3903b733bbfe4fbc3e47dd6e0
SHA1

b0d94467c95e66c7d751ec01f23c238a800f5523
SHA256

a6e50222012a8f9a05912ea58b59551537628f4fc34ce74a81942268cc00cbfa
SHA512

b1dc1539be3bf89f21f8a32eac58e2a3bde858f95aa87d8f21c98ba1126a09133d112b0d75993c8c117c43a5a2fe106bd6a371c4f686a31b7c7242994fd0a234
SSDEEP

12288:3zuNWxUw2fesyaTDP2nA61WzuaWmtPnZoZ:jxj3slbF61WpWmtPZU

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4248-133-0x00000000749B0000-0x0000000074B00000-memory.dmp	vmprotect
behavioral2/memory/4248-145-0x00000000749B0000-0x0000000074B00000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3268	4248	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4248	4996	rundll32.exe	81
PID 4996 wrote to memory of 4248	4996	rundll32.exe	81
PID 4996 wrote to memory of 4248	4996	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6e50222012a8f9a05912ea58b59551537628f4fc34ce74a81942268cc00cbfa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6e50222012a8f9a05912ea58b59551537628f4fc34ce74a81942268cc00cbfa.dll,#1
  2⤵
  PID:4248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 552
    3⤵
    - Program crash
    PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4248 -ip 4248
1⤵
PID:1260

memory/4248-132-0x0000000000000000-mapping.dmp

Download
memory/4248-133-0x00000000749B0000-0x0000000074B00000-memory.dmp

Filesize
1.3MB

Download
memory/4248-138-0x0000000036F30000-0x0000000036F40000-memory.dmp

Filesize
64KB

Download
memory/4248-137-0x0000000036F30000-0x0000000036F40000-memory.dmp

Filesize
64KB

Download
memory/4248-140-0x0000000036F30000-0x0000000036F40000-memory.dmp

Filesize
64KB

Download
memory/4248-141-0x0000000036F30000-0x0000000036F40000-memory.dmp

Filesize
64KB

Download
memory/4248-142-0x0000000036F30000-0x0000000036F40000-memory.dmp

Filesize
64KB

Download
memory/4248-139-0x0000000036F30000-0x0000000036F40000-memory.dmp

Filesize
64KB

Download
memory/4248-143-0x0000000036F30000-0x0000000036F40000-memory.dmp

Filesize
64KB

Download
memory/4248-144-0x0000000036F30000-0x0000000036F40000-memory.dmp

Filesize
64KB

Download
memory/4248-145-0x00000000749B0000-0x0000000074B00000-memory.dmp

Filesize
1.3MB

Download