094e0d4475dd858746cf55b9a6c8b4623ee5a748acb6df6f306254d7c4145a4c

Analysis

max time kernel
67s
max time network
90s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2023, 05:23

Target

winupdate32.dll
Size

10.8MB
MD5

241b59d56184d722844cdd0d779d6aca
SHA1

6da1bbec809a89fd040a8ef2fcbefba1832f03f6
SHA256

094e0d4475dd858746cf55b9a6c8b4623ee5a748acb6df6f306254d7c4145a4c
SHA512

095dbd8abd2fd5564c6de35dee6d9a1bd8dca2ecf7faab9735ac2a48dd824708b3fecebf140a676d1b27e54a34543a6be6d2a7d6c3a494a391c3c454b8ef1511
SSDEEP

6144:8KcvMjX7dDzkX3kpUPKfcXjcjOZnMqYmfCPAHlJqwS4Apo8MTStEpycYma0yfA4L:8KTrdDzi3kpSsczpCysWAtvBk8LGcH7

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1880-133-0x0000000000400000-0x0000000000488000-memory.dmp	vmprotect

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1880	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1880	5028	rundll32.exe	82
PID 5028 wrote to memory of 1880	5028	rundll32.exe	82
PID 5028 wrote to memory of 1880	5028	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\winupdate32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\winupdate32.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1880

memory/1880-133-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download