970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8

Analysis

max time kernel
1s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:50

Target

970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8.dll
Size

140KB
MD5

d457ebfcf39f9129f2c884f19806bdb0
SHA1

5db371217ebf866f8eb415cb0620fbb634463bcb
SHA256

970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8
SHA512

54668cc8e725a8a3022f57ba6ce32d4f74c929d3c2860cbabb99335ebcd803adbd8b18bd84e020ad4ca09c9c06b28adee5b412b8be3802aff33505ff9136d4f7
SSDEEP

3072:Hb4s/l8iiDXiYukRy9Vd746gh4Z91gCBzTz4y3/UHj7Nzspl+fXF:HB/l0Xi3uyJ7Mhy9dx3s3f1

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1668-56-0x0000000075000000-0x0000000075047000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8.dll,#1
  2⤵
  PID:1668

memory/1668-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1668-56-0x0000000075000000-0x0000000075047000-memory.dmp

Filesize
284KB

Download