40ee780bd009de0bac4ca96669dd68cd1295fc2372fccce377e36e270e220eab

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-04-2023 18:48

Target

40ee780bd009de0bac4ca96669dd68cd1295fc2372fccce377e36e270e220eab.dll
Size

3.0MB
MD5

d733d53f95277a5e99f97d26d76b7307
SHA1

075ab76e425d96eb4d5a4c0cebd5c418c67f5d46
SHA256

40ee780bd009de0bac4ca96669dd68cd1295fc2372fccce377e36e270e220eab
SHA512

c4270a154ec49d06d7e297c04da034b0e71f6aa30396f3ce79e68b8c0d6ee82e9c4868fde8fd5f5e6b96936ae18451041d3ee741ccedcbf668a48fd242a94d23
SSDEEP

49152:+AtvlOStdLzdHxI5ByzNaHjHvCFf0dI0H8U/04HbWa6k/r6LT/3:DllOSTXdS4zRdXU/Hy3kz6LT/

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1312-54-0x0000000010000000-0x000000001034E000-memory.dmp	vmprotect

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1312 rundll32.exe

pid	process
1312	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1408 wrote to memory of 1312	1408	rundll32.exe	rundll32.exe
PID 1408 wrote to memory of 1312	1408	rundll32.exe	rundll32.exe
PID 1408 wrote to memory of 1312	1408	rundll32.exe	rundll32.exe
PID 1408 wrote to memory of 1312	1408	rundll32.exe	rundll32.exe
PID 1408 wrote to memory of 1312	1408	rundll32.exe	rundll32.exe
PID 1408 wrote to memory of 1312	1408	rundll32.exe	rundll32.exe
PID 1408 wrote to memory of 1312	1408	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40ee780bd009de0bac4ca96669dd68cd1295fc2372fccce377e36e270e220eab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40ee780bd009de0bac4ca96669dd68cd1295fc2372fccce377e36e270e220eab.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:1312

memory/1312-54-0x0000000010000000-0x000000001034E000-memory.dmp

Filesize
3.3MB

Download