f7f43f8ed58fb83b5b67c1d133df1dbde96d0483332af9ec950bb6a6cf16baa6

Analysis

max time kernel
7s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 03:52

Target

f7f43f8ed58fb83b5b67c1d133df1dbde96d0483332af9ec950bb6a6cf16baa6.dll
Size

696KB
MD5

a176e5fbef08a4d2cf2a2ddf7fef6315
SHA1

9597393a431661bdf759622af831d85cf1eb3903
SHA256

f7f43f8ed58fb83b5b67c1d133df1dbde96d0483332af9ec950bb6a6cf16baa6
SHA512

b44d5181ea0385cf3dee24bc791e0304d10ce79d13b5bf2394750d36db39161f26c6d50e3282b5b2fccf89684ae0c7ffb34c2d16ae648ad9e6571767dc789f3a
SSDEEP

12288:EaUbU3Sc91eph4zlt2YKzjv9tZYJugIwS42YQbIOGASb8YehUBOw9GrdTC:EaUbUCW1efUkYKzjHZougz1BESb/emBJ

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1484-56-0x0000000010000000-0x00000000101D0000-memory.dmp	vmprotect
behavioral1/memory/1484-59-0x0000000010000000-0x00000000101D0000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
820	1484	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1484	rundll32.exe
Token: 33	1484	rundll32.exe
Token: SeIncBasePriorityPrivilege	1484	rundll32.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28
PID 1164 wrote to memory of 1484	1164	rundll32.exe	28
PID 1484 wrote to memory of 820	1484	rundll32.exe	29
PID 1484 wrote to memory of 820	1484	rundll32.exe	29
PID 1484 wrote to memory of 820	1484	rundll32.exe	29
PID 1484 wrote to memory of 820	1484	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7f43f8ed58fb83b5b67c1d133df1dbde96d0483332af9ec950bb6a6cf16baa6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7f43f8ed58fb83b5b67c1d133df1dbde96d0483332af9ec950bb6a6cf16baa6.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 372
    3⤵
    - Program crash
    PID:820

memory/1484-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1484-56-0x0000000010000000-0x00000000101D0000-memory.dmp

Filesize
1.8MB

Download
memory/1484-59-0x0000000010000000-0x00000000101D0000-memory.dmp

Filesize
1.8MB

Download