970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8

Analysis

max time kernel
183s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:50

Target

970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8.dll
Size

140KB
MD5

d457ebfcf39f9129f2c884f19806bdb0
SHA1

5db371217ebf866f8eb415cb0620fbb634463bcb
SHA256

970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8
SHA512

54668cc8e725a8a3022f57ba6ce32d4f74c929d3c2860cbabb99335ebcd803adbd8b18bd84e020ad4ca09c9c06b28adee5b412b8be3802aff33505ff9136d4f7
SSDEEP

3072:Hb4s/l8iiDXiYukRy9Vd746gh4Z91gCBzTz4y3/UHj7Nzspl+fXF:HB/l0Xi3uyJ7Mhy9dx3s3f1

Score

8^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1548-133-0x0000000075200000-0x0000000075247000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1548	1520	rundll32.exe	79
PID 1520 wrote to memory of 1548	1520	rundll32.exe	79
PID 1520 wrote to memory of 1548	1520	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\970c94f9d05e1f3d77ca5302f4dcfe4fd7c4f89e66d66d4841dba1eb595871d8.dll,#1
  2⤵
  PID:1548

memory/1548-133-0x0000000075200000-0x0000000075247000-memory.dmp

Filesize
284KB

Download