fb0fb81218d8bde9c9259315aa668d78ea7490ecde7b94366eb44d97872e7790

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 17:30

Target

fb0fb81218d8bde9c9259315aa668d78ea7490ecde7b94366eb44d97872e7790.dll
Size

130KB
MD5

1db94162a3ddef85cf2eb3fdc1092ac6
SHA1

488e4767be2ea1746d7da5cc89d3392b6ab6e788
SHA256

fb0fb81218d8bde9c9259315aa668d78ea7490ecde7b94366eb44d97872e7790
SHA512

846b16ecac1c5b9583c466aeb6908424e4ef25c921a456d852fa375609ebe3f0f1fb8357edd2d6ec39dffcf3d60b470c8f7c9d77b62b860c21d7940b5e2ced99
SSDEEP

3072:LH8MGmq8Fr+kHn2L0bzRMcXAZ7tc30X2vQxGJg7iv:LH8JmRtH2L0ZjXC7XXbJ

Score

8^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/980-56-0x0000000010000000-0x0000000010048000-memory.dmp	vmprotect
behavioral1/memory/980-58-0x0000000010000000-0x0000000010048000-memory.dmp	vmprotect

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fb0fb81218d8bde9c9259315aa668d78ea7490ecde7b94366eb44d97872e7790.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\fb0fb81218d8bde9c9259315aa668d78ea7490ecde7b94366eb44d97872e7790.dll	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
980	rundll32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb0fb81218d8bde9c9259315aa668d78ea7490ecde7b94366eb44d97872e7790.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb0fb81218d8bde9c9259315aa668d78ea7490ecde7b94366eb44d97872e7790.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:980

memory/980-54-0x0000000000000000-mapping.dmp

Download
memory/980-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/980-56-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/980-58-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download