1d0cb82e8d1d7be1ab8e80b1c6e4d5440918668da50e608e5c78c83910584017

Analysis

max time kernel
150s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/06/2023, 20:15

Target

1d0cb82e8d1d7be1ab8e80b1c6e4d5440918668da50e608e5c78c83910584017.dll
Size

759KB
MD5

7b1f090d86c0693d72beb887ec88e601
SHA1

54fa889bd77fa2c000c0749820512af539746039
SHA256

1d0cb82e8d1d7be1ab8e80b1c6e4d5440918668da50e608e5c78c83910584017
SHA512

f10fd14c3ba6bca381f2adbb50e1a6372fae512c5b54dbadf2cece47ebfc2085c74e6ef53e165866e199e0923cc480dfd0b5264d5b4277fde65816a027f1ecb1
SSDEEP

12288:wFnisn1fqYBMZ09zZG45l7mgbNCiFGbvX5z0iilzA2W5/zfLbaepTLt38D/R6XSN:EnjqYp9zB5VmgxtMvX5wigzo5bfL2ep8

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1216-54-0x0000000001E50000-0x0000000002011000-memory.dmp	vmprotect
behavioral1/memory/1216-55-0x0000000001E50000-0x0000000002011000-memory.dmp	vmprotect
behavioral1/memory/1216-56-0x0000000001E50000-0x0000000002011000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1216	1324	rundll32.exe	27
PID 1324 wrote to memory of 1216	1324	rundll32.exe	27
PID 1324 wrote to memory of 1216	1324	rundll32.exe	27
PID 1324 wrote to memory of 1216	1324	rundll32.exe	27
PID 1324 wrote to memory of 1216	1324	rundll32.exe	27
PID 1324 wrote to memory of 1216	1324	rundll32.exe	27
PID 1324 wrote to memory of 1216	1324	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d0cb82e8d1d7be1ab8e80b1c6e4d5440918668da50e608e5c78c83910584017.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d0cb82e8d1d7be1ab8e80b1c6e4d5440918668da50e608e5c78c83910584017.dll,#1
  2⤵
  PID:1216

memory/1216-54-0x0000000001E50000-0x0000000002011000-memory.dmp

Filesize
1.8MB

Download
memory/1216-55-0x0000000001E50000-0x0000000002011000-memory.dmp

Filesize
1.8MB

Download
memory/1216-56-0x0000000001E50000-0x0000000002011000-memory.dmp

Filesize
1.8MB

Download