f7f43f8ed58fb83b5b67c1d133df1dbde96d0483332af9ec950bb6a6cf16baa6

Analysis

max time kernel
174s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 03:52

Target

f7f43f8ed58fb83b5b67c1d133df1dbde96d0483332af9ec950bb6a6cf16baa6.dll
Size

696KB
MD5

a176e5fbef08a4d2cf2a2ddf7fef6315
SHA1

9597393a431661bdf759622af831d85cf1eb3903
SHA256

f7f43f8ed58fb83b5b67c1d133df1dbde96d0483332af9ec950bb6a6cf16baa6
SHA512

b44d5181ea0385cf3dee24bc791e0304d10ce79d13b5bf2394750d36db39161f26c6d50e3282b5b2fccf89684ae0c7ffb34c2d16ae648ad9e6571767dc789f3a
SSDEEP

12288:EaUbU3Sc91eph4zlt2YKzjv9tZYJugIwS42YQbIOGASb8YehUBOw9GrdTC:EaUbUCW1efUkYKzjHZougz1BESb/emBJ

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/448-133-0x0000000010000000-0x00000000101D0000-memory.dmp	vmprotect
behavioral2/memory/448-135-0x0000000010000000-0x00000000101D0000-memory.dmp	vmprotect
behavioral2/memory/448-136-0x0000000010000000-0x00000000101D0000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4708	448	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	448	rundll32.exe
Token: 33	448	rundll32.exe
Token: SeIncBasePriorityPrivilege	448	rundll32.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 448	640	rundll32.exe	81
PID 640 wrote to memory of 448	640	rundll32.exe	81
PID 640 wrote to memory of 448	640	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7f43f8ed58fb83b5b67c1d133df1dbde96d0483332af9ec950bb6a6cf16baa6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7f43f8ed58fb83b5b67c1d133df1dbde96d0483332af9ec950bb6a6cf16baa6.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 768
    3⤵
    - Program crash
    PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 448 -ip 448
1⤵
PID:1540

memory/448-133-0x0000000010000000-0x00000000101D0000-memory.dmp

Filesize
1.8MB

Download
memory/448-135-0x0000000010000000-0x00000000101D0000-memory.dmp

Filesize
1.8MB

Download
memory/448-136-0x0000000010000000-0x00000000101D0000-memory.dmp

Filesize
1.8MB

Download