2e88c7151d000bb0e77cda139194b0a54992bf67c3a04f20325d7712563a1d10

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22/08/2023, 06:33

Target

2e88c7151d000bb0e77cda139194b0a54992bf67c3a04f20325d7712563a1d10.dll
Size

1.6MB
MD5

395157ae43f1eb7a36ad3ca8447cba06
SHA1

795cc39a794e90e92b7104ed52ee9efb2647ab2f
SHA256

2e88c7151d000bb0e77cda139194b0a54992bf67c3a04f20325d7712563a1d10
SHA512

ebce81cdd0d3746eda47f33b920368d6bde579ee914c65fefcffda2367b7a9c747f7db74442e113f29adc3b1e4542f547d4d4c44e892019609bd7b9eed5bff7d
SSDEEP

49152:5Tz99424Hv+jAXgSGUrieHEMu2GvLELim:Zj424PPgS5WeHEMWTLm

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1612-54-0x00000000746E0000-0x0000000074AD7000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	1612	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1612	2188	rundll32.exe	28
PID 2188 wrote to memory of 1612	2188	rundll32.exe	28
PID 2188 wrote to memory of 1612	2188	rundll32.exe	28
PID 2188 wrote to memory of 1612	2188	rundll32.exe	28
PID 2188 wrote to memory of 1612	2188	rundll32.exe	28
PID 2188 wrote to memory of 1612	2188	rundll32.exe	28
PID 2188 wrote to memory of 1612	2188	rundll32.exe	28
PID 1612 wrote to memory of 2532	1612	rundll32.exe	29
PID 1612 wrote to memory of 2532	1612	rundll32.exe	29
PID 1612 wrote to memory of 2532	1612	rundll32.exe	29
PID 1612 wrote to memory of 2532	1612	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e88c7151d000bb0e77cda139194b0a54992bf67c3a04f20325d7712563a1d10.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e88c7151d000bb0e77cda139194b0a54992bf67c3a04f20325d7712563a1d10.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 276
    3⤵
    - Program crash
    PID:2532

memory/1612-54-0x00000000746E0000-0x0000000074AD7000-memory.dmp

Filesize
4.0MB

Download
memory/1612-57-0x00000000008C0000-0x00000000008CE000-memory.dmp

Filesize
56KB

Download