9cffc88ae58bd23feee4df751c30b340e84838a638d4413b044c76d07ae7e2da

Analysis

max time kernel
32s
max time network
39s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06/07/2023, 08:58

Target

CloudSDK.dll
Size

6.4MB
MD5

4f973bf01fe12baadf82886b26110cc1
SHA1

0516016c8d8092f720c2415f550c9ed17edbb5b9
SHA256

9cffc88ae58bd23feee4df751c30b340e84838a638d4413b044c76d07ae7e2da
SHA512

2bc88715ca303dd508283b255b7f5bf7ae4a4c32cf92c6d80ecf63d6d95e735839958e1c0441e91cd5dfeb06c192065f5113faee1a3ac9f7d1a2e8bbc6aa0fa5
SSDEEP

196608:VWqIz4vW8jMRutHZkAX7/tH4wAIY9YK5VT:wqEqMRAZBAr20

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1872-57-0x0000000072F20000-0x00000000739CE000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	1872	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1872	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1872	2984	rundll32.exe	28
PID 2984 wrote to memory of 1872	2984	rundll32.exe	28
PID 2984 wrote to memory of 1872	2984	rundll32.exe	28
PID 2984 wrote to memory of 1872	2984	rundll32.exe	28
PID 2984 wrote to memory of 1872	2984	rundll32.exe	28
PID 2984 wrote to memory of 1872	2984	rundll32.exe	28
PID 2984 wrote to memory of 1872	2984	rundll32.exe	28
PID 1872 wrote to memory of 2032	1872	rundll32.exe	29
PID 1872 wrote to memory of 2032	1872	rundll32.exe	29
PID 1872 wrote to memory of 2032	1872	rundll32.exe	29
PID 1872 wrote to memory of 2032	1872	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CloudSDK.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CloudSDK.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 224
    3⤵
    - Program crash
    PID:2032

memory/1872-54-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1872-55-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1872-56-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1872-57-0x0000000072F20000-0x00000000739CE000-memory.dmp

Filesize
10.7MB

Download